Merge pull request #628 from Normo/add-password-warn-age-option

Set number of warning days before user password expires
os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age
2023-02-04 18:21:52 +01:00 · 2023-02-03 14:47:27 +01:00 · 2023-02-01 16:17:36 +01:00 · 2023-02-01 11:40:40 +00:00 · 2023-02-01 12:37:31 +01:00 · 2023-01-31 06:55:37 +00:00
124 changed files with 2276 additions and 1272 deletions
@@ -4,14 +4,11 @@
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
-  - .cache/  # implicit unless exclude_paths is defined in config
+  - .cache/ # implicit unless exclude_paths is defined in config
  - .yamllint
  - ../molecule/
  - ../.github/
 skip_list:
  - fqcn-builtins
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
@@ -1,49 +0,0 @@
 ---
 name: Bug report
 about: Create a report to help us improve
 ---
 **Describe the bug**
 A clear and concise description of what the bug is.
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 **Actual behavior**
 <!--- Paste verbatim command output between quotes -->
 ```paste below
 ```
 **Example Playbook**
 <!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
 ```paste below
 ```
 **OS / Environment**
 <!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
 **Ansible Version**
 <!--- Paste verbatim output from "ansible --version" between quotes -->
 ```paste below
 ```
 **Role Version**
 <!--- Paste version of the role between quotes -->
 ```paste below
 ```
 **Additional context**
 Add any other context about the problem here.
@@ -0,0 +1,97 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Bug report"
 description: "Create a report to help us improve."
 labels: [
  "bug"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Reporting Bugs ld follow some simple rules:
        - **Check**, if you can find similar bugs
        - **Describe** what is happening and what should happen
        - **Explain** how to reproduce the problem
        - **Add** more details and attachments
        - **Follow up**, if somebody is having questions or needs more details
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Describe the bug
      placeholder: A clear and concise description of what the bug is.
    validations:
      required: true
  - type: textarea
    id: reprod
    attributes:
      label: "Reproduction steps"
      render: Shell
      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: currentbehavior
    attributes:
      label: "Current Behavior"
      description: Please describe the results you received
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: expectedbehavior
    attributes:
      label: "Expected Behavior"
      description: Please describe the results you expect
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: os
    attributes:
      label: "OS / Environment"
      value: |
        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
    validations:
      required: true
  - type: textarea
    id: ansible
    attributes:
      label: "Ansible Version"
      render: Shell
      value: |
        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: collection
    attributes:
      label: "Collection Version"
      render: Shell
      value: |
        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
      value: |
        ...
    validations:
      required: false
@@ -1,16 +0,0 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
 ---
 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Additional context**
 Add any other context or screenshots about the feature request here.
@@ -0,0 +1,55 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Feature request"
 description: "Suggest an idea for this project."
 labels: [
  "enhancement"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Requesting a new feature or enhancement is following some simple rules:
        - **Check**, if the feature is already requested
        - **Describe** what your feature will bring to the community
        - **Explain** the criteria to fulfill the request
        - **Add** more details like mock ups, attachments, lists, screenshots
        - **Follow Up** in the discussion to the feature
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Is your feature request related to a problem? Please describe.
      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
    validations:
      required: true
  - type: textarea
    id: solution
    attributes:
      label: "Solution"
      description: Describe the solution you'd like
      placeholder: A clear and concise description of what you want to happen.
    validations:
      required: false
  - type: textarea
    id: alternatives
    attributes:
      label: "Alternatives"
      description: Describe alternatives you've considered
      placeholder: A clear and concise description of any alternative solutions or features you've considered.
    validations:
      required: false
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Add any other context or screenshots about the feature request here.
      value: |
        ...
    validations:
      required: false
@@ -10,3 +10,16 @@ updates:
    directory: "/"  # Location of package manifests
    schedule:
      interval: "daily"
    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
    # however this interferes with the github changelog generator which uses these labels to define
    # a new version for the collection
    labels: [ ]
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
    # however this interferes with the github changelog generator which uses these labels to define
    # a new version for the collection
    labels: [ ]
@@ -5,9 +5,13 @@ on:  # yamllint disable-line rule:truthy
  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
  push:
    branches: [master]
    paths:
      - 'roles/**'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths:
      - 'roles/**'
 jobs:
  ansible-lint:
@@ -15,6 +15,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -37,7 +45,7 @@ jobs:
          - debian11
          # - amazon  # geerlingguy.mysql does not support fedora
          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
@@ -47,7 +55,7 @@ jobs:
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -14,6 +14,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -46,7 +54,7 @@ jobs:
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -14,6 +14,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -45,7 +53,7 @@ jobs:
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -14,6 +14,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
@@ -25,17 +33,17 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centosstream8
+          - centos8s
-          - centosstream9
+          # - centos9s  # problems with vagrant
          - rocky8
-          - rocky9
+          # - rocky9  # problems with vagrant
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
          # - opensuse42  # opensuse currently cannot get an ip address
-          # - arch  - arch is currently not supported by cinc-auditor
+          # - arch  # arch is currently not supported by cinc-auditor
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -21,6 +21,6 @@ jobs:
          ref: ${{ github.head_ref }}
      - name: Prettify code
-        uses: creyD/prettier_action@v3.1
+        uses: creyD/prettier_action@v4.2
        with:
          prettier_options: --write {**/*,*}.md
@@ -63,7 +63,7 @@ jobs:
          path: ./CHANGELOGRELEASE.md
      - name: Delete old drafts
-        uses: hugo19941994/[email protected].0
+        uses: hugo19941994/[email protected].1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,6 +14,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -46,7 +54,7 @@ jobs:
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -14,6 +14,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -46,7 +54,7 @@ jobs:
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -1,26 +0,0 @@
 ---
 # Based on ansible-lint config
 extends: default
 rules:
  braces:
    max-spaces-inside: 1
    level: error
  brackets:
    max-spaces-inside: 1
    level: error
  colons:
    max-spaces-after: -1
    level: error
  commas:
    max-spaces-after: -1
    level: error
  empty-lines:
    max: 3
    level: error
  hyphens:
    level: error
  key-duplicates: enable
  line-length: disable
  new-lines:
    type: unix
@@ -1,11 +1,92 @@
 # Changelog
-## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
+## [8.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.1) (2023-02-01)
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.5.1)
 **Merged pull requests:**
 - Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 [\#627](https://github.com/dev-sec/ansible-collection-hardening/pull/627) ([dependabot[bot]](https://github.com/apps/dependabot))
 ## [8.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.0) (2023-01-30)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...8.5.0)
 **Implemented enhancements:**
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
 - password ageing not enforced [\#570](https://github.com/dev-sec/ansible-collection-hardening/issues/570)
 - Rewrite system account detection and hardening and create tests [\#621](https://github.com/dev-sec/ansible-collection-hardening/pull/621) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - apply password age settings to exisiting regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
 **Fixed bugs:**
 - os\_hardening is setting wrong ownership for /var/log on Ubuntu [\#614](https://github.com/dev-sec/ansible-collection-hardening/issues/614)
 - \[os\_hardening\] Task for setting `initramfs` modules does not match its condition [\#590](https://github.com/dev-sec/ansible-collection-hardening/issues/590) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Support for Amazon Linux 2 [\#624](https://github.com/dev-sec/ansible-collection-hardening/pull/624) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mmitnyan](https://github.com/mmitnyan))
 **Deprecated:**
 - deprecate rebuilding of initramfs [\#618](https://github.com/dev-sec/ansible-collection-hardening/pull/618) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 **Closed issues:**
 - Ubuntu 22.04 vars file missing? [\#619](https://github.com/dev-sec/ansible-collection-hardening/issues/619)
 - SSH KexAlgorithms causes SSH daemon to fail [\#500](https://github.com/dev-sec/ansible-collection-hardening/issues/500)
 - Playbook won't run for hardening  [\#462](https://github.com/dev-sec/ansible-collection-hardening/issues/462)
 **Merged pull requests:**
 - do not let dependabot label our prs [\#626](https://github.com/dev-sec/ansible-collection-hardening/pull/626) ([rndmh3ro](https://github.com/rndmh3ro))
 - run linting only when files inside roles change [\#625](https://github.com/dev-sec/ansible-collection-hardening/pull/625) ([rndmh3ro](https://github.com/rndmh3ro))
 - cancel running tests if new commit to branch is made [\#622](https://github.com/dev-sec/ansible-collection-hardening/pull/622) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Fixed problems with running molecule locally with cgroup v2 [\#620](https://github.com/dev-sec/ansible-collection-hardening/pull/620) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
 - linting [\#603](https://github.com/dev-sec/ansible-collection-hardening/pull/603) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
 **Implemented enhancements:**
 - Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
 - Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Add OpenSUSE support  [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
 - OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 - add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
 - use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
 **Fixed bugs:**
 - os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
 - ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
 - OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 **Merged pull requests:**
 - Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
 - add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
 - add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
 ## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
 **Implemented enhancements:**
 - add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 **Fixed bugs:**
 - cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
 - do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
 **Closed issues:**
@@ -16,6 +97,8 @@
 **Merged pull requests:**
 - adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
@@ -43,7 +126,7 @@
 **Merged pull requests:**
 - update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 ## Expectations
 ## Sign off Your Work
 The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
 [Here is the full text of the DCO](http://developercertificate.org/).
 Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
 ```text
 This is my commit message
 Signed-off-by: Random J Developer <[email protected]>
 ```
 Git even has a -s command line option to append this automatically to your commit message:
 ```text
 git commit -s -m 'This is my commit message'
 ```
 ### Don't reinvent the wheel
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.2.0
+version: 8.5.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -1,2 +1,2 @@
 ---
-requires_ansible: '>=2.9.10'
+requires_ansible: ">=2.9.10"
@@ -24,6 +24,13 @@
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - include_role:
        name: mysql_hardening
  vars:
@@ -11,8 +11,9 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
    cgroupns_mode: host
    pre_build_image: true
    environment:
      container: docker
@@ -25,6 +26,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -15,6 +15,12 @@
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int >= 11
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - name: Use Python 2 on Debian 10
      set_fact:
        ansible_python_interpreter: /usr/bin/python
@@ -29,11 +35,9 @@
        update_cache: true
      when: ansible_os_family == 'Debian'
-    - name: install required tools on SuSE
+    - name: Install required python packages on Suse
-      community.general.zypper:
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-        name: "python-xml"
+      when: ansible_os_family == 'Suse'
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: create missing directory
      file:
@@ -56,7 +60,6 @@
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - include_role:
        name: dev-sec.mysql
@@ -34,6 +34,9 @@
        update_cache: true
      when: ansible_distribution == 'Debian'
    - name: include tests for the service
      include_tasks: verify_tasks/service.yml
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
@@ -0,0 +1,16 @@
 ---
 - name: Load variables from role to use the "mysql_daemon" variable
  ansible.builtin.include_role:
    name: devsec.hardening.mysql_hardening
    apply:
      tags:
        - never
 - name: Populate service facts
  ansible.builtin.service_facts:
 - name: Check if MySQL is running and enabled
  assert:
    that:
      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -17,6 +17,7 @@
  vars:
    os_security_users_allow: change_user
    os_security_kernel_enable_core_dump: false
    os_auditd_num_logs: 10
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
@@ -27,7 +28,11 @@
    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
    os_filesystem_whitelist: []
    os_yum_repo_file_whitelist: ['foo.repo']
    os_users_without_password_ageing: ['pw_no_ageing']
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
    os_ignore_users: ["shell_sys_acc"]
    os_ignore_home_folder_users: ["user_with_777_home"]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -59,6 +59,11 @@
      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
-    - name: include YUM prepare tasks
+    - name: include preparation tasks
-      include_tasks: prepare_tasks/netrc.yml
+      ansible.builtin.include_tasks:
-
+        file: "{{ item }}"
      loop:
        - prepare_tasks/netrc.yml
        - prepare_tasks/pw_ageing.yml
        - prepare_tasks/sys_account_shell.yml
        - prepare_tasks/ignore_home_folders.yml
@@ -0,0 +1,9 @@
 ---
 - name: Create user whose home-folder should not be touched
  ansible.builtin.user:
    name: "user_with_777_home"
 - name: Change mode of home-folder for user to 777
  ansible.builtin.file:
    path: /home/user_with_777_home
    mode: "0777"
@@ -0,0 +1,9 @@
 - name: Create user those password ageing should not be changed
  user:
    name: "pw_no_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
 - name: Create user those password ageing should be changed
  user:
    name: "pw_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
@@ -0,0 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
  user:
    name: "shell_sys_acc"
    shell: "/bin/bash"
@@ -37,8 +37,14 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'
-    - name: include netrc tests
+    - name: include verification tasks
-      include_tasks: verify_tasks/netrc.yml
+      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop: 
        - verify_tasks/sys_account_shell.yml
        - verify_tasks/pw_ageing.yml
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml
    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
@@ -58,7 +64,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,10 @@
 ---
 - name: Get properties of user user_with_777_home's home-folder
  ansible.builtin.stat:
    path: /home/user_with_777_home
  register: stats
 - name: Check that the home-folder has mode 777
  ansible.builtin.assert:
    that:
      - stats.stat.mode == "0777"
@@ -0,0 +1,32 @@
 ---
 - name: Get Password Expiry date for use pw_no_ageing
  ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_no_ageing is "never"
  ansible.builtin.assert:
    that:
      - "expiry_date.stdout | trim == 'never'"
 - name: Get Password Expiry date for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_ageing is 60 days
  ansible.builtin.assert:
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_warndays
 - name: Check that number of days of warning before password expires is 7 days
  ansible.builtin.assert:
    that:
      - "expiry_warndays.stdout | trim == '7'"
@@ -0,0 +1,8 @@
 - name: Read local linux user database
  getent:
    database: passwd
 - name: Check that shell_sys_acc's shell is still bash
  assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -0,0 +1,9 @@
 os-14:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-15:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-16:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
@@ -14,6 +14,8 @@ platforms:
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
@@ -16,8 +16,6 @@
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
        name: "*"
        state: latest
        update_cache: true
      when: ansible_os_family == 'Debian'
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -42,7 +42,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -16,6 +16,7 @@ It configures:
 - Ansible 2.9.0
 - An existing MySQL installation
 - python-jmespath on the ansible host
 ### Example playbook
@@ -7,9 +7,9 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true
 # general configuration
-mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
+mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
-mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed
 mysql_user_home: "{{ ansible_env.HOME }}"
@@ -48,6 +48,6 @@ mysql_hardening_options:
  automatic-sp-privileges: 0
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
-  secure-file-priv: '/tmp'
+  secure-file-priv: /tmp
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{ mysql_hardening_user }}'
+  user: "{{ mysql_hardening_user }}"
@@ -1,7 +1,6 @@
 ---
 - name: Restart mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
    state: restarted
  when: mysql_hardening_restart_mysql | bool
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible playbook provides security configuration for mysql.'
+  description: This Ansible playbook provides security configuration for mysql.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
@@ -1,64 +1,64 @@
 ---
 - name: Protect my.cnf
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_conf_file }}'
+    path: "{{ mysql_hardening_mysql_conf_file }}"
-    mode: '0640'
+    mode: "0640"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
    follow: true
    state: file
 - name: Ensure permissions on mysql-datadir are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_user }}'
+    group: "{{ mysql_hardening_user }}"
-    mode: '0750'
+    mode: "0750"
  when: item is defined and item != ""
  loop:
-    - '{{ mysql_settings.settings.datadir }}'
+    - "{{ mysql_settings.settings.datadir }}"
    - '{{ mysql_datadir | default("") }}'
 - name: Ensure permissions on mysql-logfile are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: file
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0640'
+    mode: "0640"
  when: item is defined and item != ""
  loop:
-    - '{{ mysql_settings.settings.log_error }}'
+    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
 - name: Check mysql configuration-directory exists and has right permissions
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_confd_dir }}'
+    path: "{{ mysql_hardening_mysql_confd_dir }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0750'
+    mode: "0750"
 - name: Check include-dir directive is present in my.cnf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: '{{ mysql_hardening_mysql_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_conf_file }}"
-    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
+    line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
-    insertafter: 'EOF'
+    insertafter: EOF
    state: present
    backup: true
  notify: Restart mysql
 - name: Apply hardening configuration
-  template:
+  ansible.builtin.template:
-    src: 'hardening.cnf.j2'
+    src: hardening.cnf.j2
-    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
-    mode: '0640'
+    mode: "0640"
  notify: Restart mysql
 - name: Enable mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
-    enabled: '{{ mysql_daemon_enabled }}'
+    enabled: "{{ mysql_daemon_enabled }}"
@@ -1,31 +1,31 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact maches.
- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
 - name: Check that the variable mysql_distribution is set correctly
  ansible.builtin.assert:
    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
-    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+    fail_msg: mysql_distribution must be set to either mysql or mariadb!
  when: mysql_distribution is defined
 - name: Gather package facts to check for mysql/mariadb version
@@ -34,7 +34,7 @@
  when: not mysql_distribution is defined
 - name: Check if MySQL or MariaDB is used
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
  when: not mysql_distribution is defined
@@ -53,18 +53,20 @@
 # see https://stackoverflow.com/a/59451077/2953919 for the
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
  when:
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"
- include: configure.yml
+- name: Include tasks for configuration
  ansible.builtin.import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
  ansible.builtin.import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
@@ -1,104 +1,107 @@
 ---
 - name: Fail the role if the mysql root password was not set
-  fail:
+  ansible.builtin.fail:
-    msg: 'ERROR - you have to change default mysql_root_password'
+    msg: ERROR - you have to change default mysql_root_password
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
- name: ensure that the root password is present
+- name: Ensure that the root password is present
  community.mysql.mysql_user:
-    name: 'root'
+    name: root
    host_all: true
-    password: '{{ mysql_root_password | mandatory }}'
+    password: "{{ mysql_root_password | mandatory }}"
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 - name: Install .my.cnf with credentials
-  template:
+  ansible.builtin.template:
-    src: 'my.cnf.j2'
+    src: my.cnf.j2
-    dest: '{{ mysql_user_home }}/.my.cnf'
+    dest: "{{ mysql_user_home }}/.my.cnf"
-    mode: '0400'
+    mode: "0400"
  tags: my_cnf
- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database
- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
  community.mysql.mysql_user:
-    name: ''
+    name: ""
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users
- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
  community.mysql.mysql_query:
-    query:
+    query: >
-      - DELETE
+      DELETE
-        FROM mysql.user
+      FROM mysql.user
-        WHERE USER='root'
+      WHERE USER='root'
-          AND HOST NOT IN ('localhost',
+        AND HOST NOT IN ('localhost',
-                          '127.0.0.1',
+                         '127.0.0.1',
-                          '::1')
+                         '::1');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root
- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
-        FROM mysql.user
+      FROM mysql.user
-        WHERE (length(authentication_string)=0
+      WHERE (length(authentication_string)=0
-              OR authentication_string="")
+             OR authentication_string="")
-          AND USER NOT IN ('mysql.sys',
+        AND USER NOT IN ('mysql.sys',
-                          'mysqlxsys',
+                         'mysqlxsys',
-                          'mariadb.sys');
+                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords_or_auth_string
-  when:
+  when: >
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+    (mysql_distribution == "mariadb" and mysql_version.version.full
    is version('10.4.0', '>='))
- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
-        FROM mysql.user
+      FROM mysql.user
-        WHERE (length(password)=0
+      WHERE (length(password)=0
-              OR password="")
+             OR password="")
-          AND (length(authentication_string)=0
+        AND (length(authentication_string)=0
-              OR authentication_string="")
+             OR authentication_string="")
-          AND USER NOT IN ('mysql.sys',
+        AND USER NOT IN ('mysql.sys',
-                          'mysqlxsys',
+                         'mysqlxsys',
-                          'mariadb.sys');
+                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords
-  when:
+  when: >
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+    (mysql_distribution == "mariadb" and mysql_version.version.full is
    version('10.4.0', '<'))
- name: create a fact for users without password or authentication_string
+- name: Create a fact for users without password or authentication_string
-  set_fact:
+  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords_or_auth_string.query_result is defined
-    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
+    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
- name: create a fact for users without password
+- name: Create a fact for users without password
-  set_fact:
+  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords.query_result is defined
-    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
+    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
- name: ensure that there are no users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
-      - "DROP USER {{ users_wo_auth }}"
+      - DROP USER {{ users_wo_auth }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when:
    - users_wo_auth is defined
-    - users_wo_auth != ""  # noqa empty-string-compare
+    - users_wo_auth != "" # noqa empty-string-compare
@@ -1,10 +1,10 @@
 ---
-mysql_daemon: mysql
+mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
@@ -1,4 +1,4 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
@@ -1,10 +1,10 @@
 ---
 mysql_daemon: mysql-server
-mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /usr/local/etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /usr/local/etc/mysql/conf.d
-mysql_hardening_group: 'mysql'
+mysql_hardening_group: mysql
-mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /usr/local/etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /usr/local/etc/mysql/*.cnf files
@@ -1,7 +1,7 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
@@ -1,9 +1,9 @@
 ---
 mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
-mysql_hardening_group: 'mysql'
+mysql_hardening_group: mysql
@@ -0,0 +1,10 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'
@@ -1,10 +1,10 @@
 ---
 mysql_daemon: mysql
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
@@ -1,3 +1,2 @@
 ---
-
+mysql_hardening_user: mysql # owner of data
 mysql_hardening_user: 'mysql'  # owner of data
@@ -1,20 +1,20 @@
 ---
-nginx_client_body_buffer_size: '1k'
+nginx_client_body_buffer_size: 1k
 nginx_remove_default_site: true
-nginx_client_max_body_size: '1k'
+nginx_client_max_body_size: 1k
-nginx_keepalive_timeout: '5 5'
+nginx_keepalive_timeout: 5 5
-nginx_server_tokens: 'off'
+nginx_server_tokens: "off"
-nginx_client_header_buffer_size: "1k"
+nginx_client_header_buffer_size: 1k
-nginx_large_client_header_buffers: "2 1k"
+nginx_large_client_header_buffers: 2 1k
 nginx_client_body_timeout: "10"
 nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
-nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
+nginx_limit_conn_zone: $binary_remote_addr zone=default:10m
-nginx_limit_conn: "default 5"
+nginx_limit_conn: default 5
-nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_dir: /etc/nginx
-nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: /etc/nginx
-nginx_owner_user: "root"
+nginx_owner_user: root
-nginx_owner_group: "root"
+nginx_owner_group: root
 nginx_add_header:
  # avoid clickjacking
  - X-Frame-Options SAMEORIGIN
@@ -27,7 +27,8 @@ nginx_add_header:
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
+nginx_ssl_protocols: TLSv1.2 TLSv1.3
-nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
+# yamllint disable-line rule:line-length
 nginx_ssl_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
 nginx_ssl_session_tickets: "off"
 nginx_dh_size: "4096"
@@ -1,5 +1,5 @@
 ---
 - name: Restart nginx
-  service:
+  ansible.builtin.service:
-    name: "nginx"
+    name: nginx
    state: restarted
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
+  description: This Ansible role provides secure nginx configurations. http://dev-sec.io/
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
@@ -1,81 +1,81 @@
 ---
 - name: Create additional configuration
-  template:
+  ansible.builtin.template:
-    src: "hardening.conf.j2"
+    src: hardening.conf.j2
    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
-    mode: '0600'
+    mode: "0600"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change configuration in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*server_tokens'
+    regexp: ^\s*server_tokens
    line: "    server_tokens {{ nginx_server_tokens }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_protocols in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_protocols'
+    regexp: ^\s*ssl_protocols
    line: "    ssl_protocols {{ nginx_ssl_protocols }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_prefer_server_ciphers in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_prefer_server_ciphers'
+    regexp: ^\s*ssl_prefer_server_ciphers
    line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_max_body_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_max_body_size'
+    regexp: ^\s*client_max_body_size
    line: "    client_max_body_size {{ nginx_client_max_body_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_body_buffer_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_body_buffer_size'
+    regexp: ^\s*client_body_buffer_size
    line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change keepalive_timeout in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*keepalive_timeout'
+    regexp: ^\s*keepalive_timeout
    line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Remove default.conf
-  file:
+  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  when: nginx_remove_default_site
@@ -85,10 +85,10 @@
    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 - name: Generate dh group
-  openssl_dhparam:
+  community.crypto.openssl_dhparam:
    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
@@ -107,6 +107,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
 - `os_auth_pw_warn_age`
  - Default: `7`
  - Description: number of days of warning before password expires.
 - `os_auth_pw_remember`
  - Default: `5`
  - Description: how many used passwords are record.
@@ -137,6 +140,7 @@ We know that this is the case on Raspberry Pi.
 - `os_security_kernel_enable_module_loading`
  - Default: `true`
  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`).
  - WARNING: Rebuilding initramfs is deprecated and will be removed in the next major release. For more information take a look at this issue: <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
 - `os_security_kernel_enable_core_dump`
  - Default: `false`
  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
@@ -218,6 +222,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auditd_max_log_file`
  - Default: `6`
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action. The value given must be numeric.
 - `os_auditd_num_logs`
  - Default: `5`
  - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
 - `hidepid_option`
  - Default: `2` (on RHEL/CentOS7 `0`, see known limitations)
  - Description: `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc.
@@ -227,9 +234,27 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_users`
  - Default: `['vagrant', 'kitchen']`
  - Description: Specify system accounts whose login should not be disabled and password not changed
 - `os_chmod_home_folders`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of home folders for regular users
 - `os_ignore_home_folder_users`
-  - Default: `lost+found`
+  - Default: `[]`
-  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+  - Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 - `os_chmod_rootuser_home_folder`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of root's home folder
 - `os_rootuser_pw_ageing`
  - Default: `false`
  - Description: Set to true to enforce password age settings for root user(s)
 - `os_remove_additional_root_users`
  - Default: `false`
  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_user_pw_ageing`
  - Default: `true`
  - Description: Set to false to disable password age enforcement on existing users
 - `os_users_without_password_ageing`
  - Default: `[]`
  - Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 - `os_cron_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring cron.
@@ -241,7 +266,7 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
  - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring minimize_access.
@@ -287,6 +312,30 @@ We know that this is the case on Raspberry Pi.
 - `os_sha_crypt_max_rounds`
  - Default: `640000`
  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring `auditd`.
 - `os_auditd_flush`
  - Default: `INCREMENTAL`
  - Description: Valid values are none, incremental, incremental_async, data, and sync.
 - `os_auditd_max_log_file`
  - Default: 6
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action.
 - `os_auditd_max_log_file_action`
  - Default: `keep_logs`
  - Description: This parameter tells the system what action to take when the system has detected that the max file size limit has been reached. Valid values are ignore, syslog, suspend, rotate and keep_logs.
 - `os_auditd_admin_space_left`
  - Default: 50
  - Description: This is a numeric value in megabytes that tells the audit daemon when to perform a configurable action because the system is running low on disk space.
 - `os_auditd_space_left`
  - Default: 75
  - Description: If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by space_left_action.
 - `os_auditd_space_left_action`
  - Default: SYSLOG
  - Description: This parameter tells the system what action to take when the system has detected that it is starting to get low on disk space.
 - `os_auditd_log_format`
  - Default: `RAW`
  - Description: The log format describes how the information should be stored on disk. There are 2 options: raw and enriched. If set to `RAW`, the audit records will be stored in a format exactly as the kernel sends it. The `ENRICHED` option will resolve all uid, gid, syscall, architecture, and socket address information before writing the event to disk. This aids in making sense of events created on one system but reported/analyzed on another system.
 - `os_mnt_boot_dir_mode`
  - Default: `0700`
  - Description: Set default perimissions for /boot
@@ -2,28 +2,42 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
-os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_min_age: 7 # Discourage password cycling
-os_auth_pw_remember: 5  # Specify how many used passwords are record
+os_auth_pw_warn_age: 7
 os_auth_pw_remember: 5 # Specify how many used passwords are record
 os_auth_retries: 5
-os_auth_lockout_time: 600  # Seconds (600 = 10min)
+os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
+os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
+os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 os_chfn_restrict: ""
-os_chfn_restrict: ''
+# Set to `false` to disable "chmod 700" of home folders for regular users
-
+os_chmod_rootuser_home_folder: true
 # Set to false to disable chmod /home folders to 700
 os_chmod_home_folders: true
 # Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 os_ignore_home_folder_users: []
 # May contain: change_user
 os_security_users_allow: []
-# Specify user home folders in /home that shouldn't be chmodded to 700
+
-os_ignore_home_folder_users: ['lost+found']
+# Set to false to disable password age enforcement on existing users
 os_rootuser_pw_ageing: false
 # When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 os_remove_additional_root_users: false
 # Set to false to disable password age enforcement on existing users
 os_user_pw_ageing: true
 # List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 os_users_without_password_ageing: []
 # Specify system accounts whose login should not be disabled and password not changed
-os_ignore_users: ['vagrant', 'kitchen']
+os_ignore_users: [vagrant, kitchen]
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
@@ -35,8 +49,7 @@ os_security_suid_sgid_remove_from_unknown: false
 # Remove packages with known security issues
 os_security_packages_clean: true
-os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
+os_security_packages_list: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
 # Allow interactive startup (rhel, centos)
 os_security_init_prompt: true
 # Require root password for single user mode. (rhel, centos)
@@ -49,15 +62,15 @@ ufw_manage_defaults: true
 # By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
 # CAUTION!
 # If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
-ufw_ipt_sysctl: ''
+ufw_ipt_sysctl: ""
 # Default ufw variables
-ufw_default_input_policy: 'DROP'
+ufw_default_input_policy: DROP
-ufw_default_output_policy: 'ACCEPT'
+ufw_default_output_policy: ACCEPT
-ufw_default_forward_policy: 'DROP'
+ufw_default_forward_policy: DROP
-ufw_default_application_policy: 'SKIP'
+ufw_default_application_policy: SKIP
-ufw_manage_builtins: 'no'
+ufw_manage_builtins: "no"
-ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
+ufw_ipt_modules: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
 # Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted).
@@ -253,6 +266,7 @@ sysctl_config:
  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
  net.ipv6.conf.default.router_solicitations: 0
  net.ipv6.conf.all.router_solicitations: 0
  # Disable Accept Router Preference from router advertisement | sysctl-22
  net.ipv6.conf.default.accept_ra_rtr_pref: 0
@@ -265,6 +279,7 @@ sysctl_config:
  # Disable IPv6 autoconfiguration | sysctl-26
  net.ipv6.conf.default.autoconf: 0
  net.ipv6.conf.all.autoconf: 0
  # Disable neighbor solicitations to send out per address | sysctl-27
  net.ipv6.conf.default.dad_transmits: 0
@@ -291,35 +306,43 @@ sysctl_config:
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
 # Disable unused filesystems
 os_unused_filesystems:
-  - "cramfs"
+  - cramfs
-  - "freevxfs"
+  - freevxfs
-  - "jffs2"
+  - jffs2
-  - "hfs"
+  - hfs
-  - "hfsplus"
+  - hfsplus
-  - "squashfs"
+  - squashfs
-  - "udf"
+  - udf
-  - "vfat"
+  - vfat
  # Obsolete network protocols that should be disabled
  # per CIS Oracle Linux 6 Benchmark (2016)
-  - "dccp"  # CIS 3.5.1
+  - dccp # CIS 3.5.1
-  - "rds"   # CIS 3.5.3
+  - rds # CIS 3.5.3
-  - "sctp"  # CIS 3.5.2
+  - sctp # CIS 3.5.2
-  - "tipc"  # CIS 3.5.4
+  - tipc # CIS 3.5.4
 # Whitelist for used filesystems
 os_filesystem_whitelist: []
 # Set to false to turn the role into a no-op. Useful when using
 # the Ansible role dependency mechanism.
 os_hardening_enabled: true
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
 os_auditd_flush: INCREMENTAL
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
 os_auditd_space_left_action: SYSLOG
 os_auditd_admin_space_left_action: SUSPEND
 os_auditd_disk_full_action: SUSPEND
 os_auditd_disk_error_action: SUSPEND
 os_auditd_log_group: root
 os_auditd_num_logs: 5
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
@@ -327,7 +350,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true
@@ -338,7 +361,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 # Set to false to disable installing and configuring minimize_access.
@@ -373,7 +396,6 @@ os_yum_enabled: true
 # List of yum repository files under /etc/yum.repos.d/ which should not be altered.
 os_yum_repo_file_whitelist: []
 # Set to false to disable installing and configuring apt.
 os_apt_enabled: true
@@ -386,82 +408,82 @@ os_selinux_enabled: true
 os_sha_crypt_min_rounds: "640000"
 os_sha_crypt_max_rounds: "640000"
-os_mnt_boot_dir_mode: '0700'
+os_mnt_boot_dir_mode: "0700"
 os_mnt_boot_enabled: false
 os_mnt_boot_src: ""
-os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
+os_mnt_boot_options: rw,nosuid,nodev,noexec
 os_mnt_boot_filesystem: ""
 os_mnt_boot_dump: ""
 os_mnt_boot_passno: ""
-os_mnt_dev_dir_mode: '0755'
+os_mnt_dev_dir_mode: "0755"
 os_mnt_dev_enabled: true
-os_mnt_dev_src: "devtmpfs"
+os_mnt_dev_src: devtmpfs
-os_mnt_dev_options: 'rw,nosuid,noexec'
+os_mnt_dev_options: rw,nosuid,noexec
-os_mnt_dev_filesystem: "devtmpfs"
+os_mnt_dev_filesystem: devtmpfs
 os_mnt_dev_dump: ""
 os_mnt_dev_passno: ""
-os_mnt_dev_shm_dir_mode: '1777'
+os_mnt_dev_shm_dir_mode: "1777"
 os_mnt_dev_shm_enabled: true
-os_mnt_dev_shm_src: "tmpfs"
+os_mnt_dev_shm_src: tmpfs
-os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
+os_mnt_dev_shm_options: rw,nosuid,nodev,noexec
-os_mnt_dev_shm_filesystem: "tmpfs"
+os_mnt_dev_shm_filesystem: tmpfs
 os_mnt_dev_shm_dump: ""
 os_mnt_dev_shm_passno: ""
-os_mnt_home_dir_mode: '0755'
+os_mnt_home_dir_mode: "0755"
 os_mnt_home_enabled: false
 os_mnt_home_src: ""
-os_mnt_home_options: 'rw,nosuid,nodev'
+os_mnt_home_options: rw,nosuid,nodev
 os_mnt_home_filesystem: ""
 os_mnt_home_dump: ""
 os_mnt_home_passno: ""
-os_mnt_run_dir_mode: '0755'
+os_mnt_run_dir_mode: "0755"
 os_mnt_run_enabled: true
-os_mnt_run_src: "tmpfs"
+os_mnt_run_src: tmpfs
-os_mnt_run_options: 'rw,nosuid,nodev'
+os_mnt_run_options: rw,nosuid,nodev
-os_mnt_run_filesystem: "tmpfs"
+os_mnt_run_filesystem: tmpfs
 os_mnt_run_dump: ""
 os_mnt_run_passno: ""
-os_mnt_tmp_dir_mode: '1777'
+os_mnt_tmp_dir_mode: "1777"
 os_mnt_tmp_enabled: false
 os_mnt_tmp_src: ""
-os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_tmp_filesystem: ""
 os_mnt_tmp_dump: ""
 os_mnt_tmp_passno: ""
-os_mnt_var_dir_mode: '0755'
+os_mnt_var_dir_mode: "0755"
 os_mnt_var_enabled: false
 os_mnt_var_src: ""
-os_mnt_var_options: 'rw,nosuid,nodev'
+os_mnt_var_options: rw,nosuid,nodev
 os_mnt_var_filesystem: ""
 os_mnt_var_dump: ""
 os_mnt_var_passno: ""
-os_mnt_var_log_dir_mode: '0755'
+os_mnt_var_log_dir_mode: "0755"
 os_mnt_var_log_enabled: false
 os_mnt_var_log_src: ""
-os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_filesystem: ""
 os_mnt_var_log_dump: ""
 os_mnt_var_log_passno: ""
-os_mnt_var_log_audit_dir_mode: '0700'
+os_mnt_var_log_audit_dir_mode: "0700"
 os_mnt_var_log_audit_enabled: false
 os_mnt_var_log_audit_src: ""
-os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_audit_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_audit_filesystem: ""
 os_mnt_var_log_audit_dump: ""
 os_mnt_var_log_audit_passno: ""
-os_mnt_var_tmp_dir_mode: '1777'
+os_mnt_var_tmp_dir_mode: "1777"
 os_mnt_var_tmp_enabled: false
 os_mnt_var_tmp_src: ""
-os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_var_tmp_filesystem: ""
 os_mnt_var_tmp_dump: ""
 os_mnt_var_tmp_passno: ""
@@ -1,19 +1,18 @@
 ---
 - name: Update-initramfs
-  command: 'update-initramfs -u'
+  ansible.builtin.command: update-initramfs -u
- name: restart-auditd
+- name: Restart auditd # noqa command-instead-of-module
-  command:
+  ansible.builtin.command:
-    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
+  when: molecule_yml is not defined # restarting auditd in a container does not work
  when: molecule_yml is not defined  # restarting auditd in a container does not work
 - name: Reload systemd
-  systemd:
+  ansible.builtin.systemd:
    daemon_reload: true
 - name: Remount filesystems
-  mount:
+  ansible.posix.mount:
    path: "{{ item }}"
    state: remounted
  loop: "{{ mountpoints_changed }}"
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
+  description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
@@ -1,7 +1,7 @@
 ---
 - name: Remove deprecated or insecure packages | package-01 - package-09
-  apt:
+  ansible.builtin.apt:
-    name: '{{ os_security_packages_list }}'
+    name: "{{ os_security_packages_list }}"
-    state: 'absent'
+    state: absent
-    purge: 'yes'
+    purge: true
  when: os_security_packages_clean | bool
@@ -1,16 +1,16 @@
 ---
 - name: Install auditd package | package-08
-  package:
+  ansible.builtin.package:
-    name: '{{ auditd_package }}'
+    name: "{{ auditd_package }}"
-    state: 'present'
+    state: present
  tags: auditd
 - name: Configure auditd | package-08
-  template:
+  ansible.builtin.template:
-    src: 'etc/audit/auditd.conf.j2'
+    src: etc/audit/auditd.conf.j2
-    dest: '/etc/audit/auditd.conf'
+    dest: /etc/audit/auditd.conf
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0640'
+    mode: "0640"
-  notify: 'restart-auditd'
+  notify: Restart auditd
  tags: auditd
@@ -6,7 +6,7 @@
 # CIS 5.1.2 - CIS 5.1.7
 #
 - name: Find cron files and directories
-  find:
+  ansible.builtin.find:
    paths:
      - /etc
    patterns:
@@ -1,6 +1,6 @@
 ---
 - name: Disable CTRL-ALT-DEL
-  systemd:
+  ansible.builtin.systemd:
    name: ctrl-alt-del.target
    masked: true
    daemon_reload: true
@@ -1,101 +1,129 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
- import_tasks: auditd.yml
+- name: Import tasks for auditd
  ansible.builtin.import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool
- import_tasks: cron.yml
+- name: Import tasks for cron
  ansible.builtin.import_tasks: cron.yml
  tags: cron
  when: os_cron_enabled | bool
- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
  ansible.builtin.import_tasks: ctrlaltdel.yml
  tags: ctrlaltdel
  when: os_ctrlaltdel_disabled | bool
- import_tasks: limits.yml
+- name: Import tasks to configure limits
  ansible.builtin.import_tasks: limits.yml
  tags: limits
  when: os_limits_enabled | bool
- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
  ansible.builtin.import_tasks: login_defs.yml
  tags: login_defs
  when: os_login_defs_enabled | bool
- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
  ansible.builtin.import_tasks: minimize_access.yml
  tags: minimize_access
  when: os_minimize_access_enabled | bool
- import_tasks: pam.yml
+- name: Import tasks to configure PAM
  ansible.builtin.import_tasks: pam.yml
  tags: pam
  when: os_pam_enabled | bool
- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
  ansible.builtin.import_tasks: modprobe.yml
  tags: modprobe
  when: os_modprobe_enabled | bool
- import_tasks: profile.yml
+- name: Import tasks to configure profile
  ansible.builtin.import_tasks: profile.yml
  tags: profile
  when: os_profile_enabled | bool
- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
  ansible.builtin.import_tasks: securetty.yml
  tags: securetty
  when: os_securetty_enabled | bool
- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
  ansible.builtin.import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
  tags: suid_sgid
- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
  ansible.builtin.import_tasks: sysctl.yml
  tags: sysctl
  when: os_sysctl_enabled | bool
- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
  ansible.builtin.import_tasks: user_accounts.yml
  tags: user_accounts
  when: os_user_accounts_enabled | bool
- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
  ansible.builtin.import_tasks: rhosts.yml
  tags: rhosts
  when: os_rhosts_enabled | bool
- import_tasks: netrc.yml
+- name: Import tasks to configure netrc
  ansible.builtin.import_tasks: netrc.yml
  tags: netrc
  when: os_netrc_enabled | bool
- import_tasks: yum.yml
+- name: Import tasks to configure yum
  ansible.builtin.import_tasks: yum.yml
  tags: yum
  when:
    - ansible_facts.os_family == 'RedHat'
    - os_yum_enabled | bool
- import_tasks: apt.yml
+- name: Import tasks to configure apt
  ansible.builtin.import_tasks: apt.yml
  tags: apt
  when:
    - ansible_facts.os_family == 'Debian'
    - os_apt_enabled | bool
- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
  ansible.builtin.import_tasks: selinux.yml
  tags: selinux
  when:
    - ansible_facts.selinux.status == 'enabled'
    - os_selinux_enabled | bool
 - name: Raise deprecation warning for initramfs tasks  # noqa ignore-errors
  ansible.builtin.fail:
    msg: "WARNING: Rebuilding initramfs is deprecated and will be removed
          in the next major release. For more information take a look at this issue:
          https://github.com/dev-sec/ansible-collection-hardening/pull/591"
  when:
    - os_security_kernel_enable_module_loading
  ignore_errors: true
  tags: always
@@ -1,65 +1,64 @@
 ---
- name: disable coredumps
+- name: Disable coredumps
  block:
  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
      path: '/etc/security/limits.d'
      owner: 'root'
      group: 'root'
      mode: '0755'
      state: 'directory'
  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
    pam_limits:
      dest: '/etc/security/limits.d/10.hardcore.conf'
      domain: '*'
      limit_type: hard
      limit_item: core
      value: '0'
      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
  - name: Set 10.hardcore.conf perms to 0400 and root ownership
    file:
      path: /etc/security/limits.d/10.hardcore.conf
      owner: 'root'
      group: 'root'
      mode: '0440'
      state: touch
      modification_time: preserve
      access_time: preserve
  - name: create coredump.conf.d-directory if it does not exist
    file:
      path: '/etc/systemd/coredump.conf.d'
      owner: root
      group: root
      mode: 0755
      state: directory
    when: ansible_service_mgr == "systemd"
  - name: create custom.conf for disabling coredumps
    template:
      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
      dest: '/etc/systemd/coredump.conf.d/custom.conf'
      owner: root
      group: root
      mode: 0644
    when: ansible_service_mgr == "systemd"
    notify: Reload systemd
  when: not os_security_kernel_enable_core_dump | bool
  block:
    - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
      ansible.builtin.file:
        path: /etc/security/limits.d
        owner: root
        group: root
        mode: "0755"
        state: directory
- name: enable coredumps
+    - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
      community.general.pam_limits:
        dest: /etc/security/limits.d/10.hardcore.conf
        domain: "*"
        limit_type: hard
        limit_item: core
        value: "0"
        comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
    - name: Set 10.hardcore.conf perms to 0400 and root ownership
      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
        owner: root
        group: root
        mode: "0440"
        state: touch
        modification_time: preserve
        access_time: preserve
    - name: Create coredump.conf.d-directory if it does not exist
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        owner: root
        group: root
        mode: 0755
        state: directory
      when: ansible_service_mgr == "systemd"
    - name: Create custom.conf for disabling coredumps
      ansible.builtin.template:
        src: etc/systemd/coredump.conf.d/coredumps.conf.j2
        dest: /etc/systemd/coredump.conf.d/custom.conf
        owner: root
        group: root
        mode: 0644
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
 - name: Enable coredumps
  when: os_security_kernel_enable_core_dump | bool
  block:
    - name: Remove coredump.conf.d directory with files
-      file:
+      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        state: absent
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
    - name: Remove 10.hardcore.conf config file
-      file:
+      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
        state: absent
  when: os_security_kernel_enable_core_dump | bool
@@ -1,8 +1,8 @@
 ---
 - name: Create login.defs | os-05, os-05b
-  template:
+  ansible.builtin.template:
-    src: 'etc/login.defs.j2'
+    src: etc/login.defs.j2
-    dest: '/etc/login.defs'
+    dest: /etc/login.defs
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0444'
+    mode: "0444"
@@ -1,5 +1,6 @@
 ---
- include_tasks: hardening.yml
+- name: Include hardening tasks
  ansible.builtin.include_tasks: hardening.yml
  when: os_hardening_enabled | bool
  tags:
    - always
@@ -4,103 +4,193 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
- name: Find files with write-permissions for group
+- name: Find files with write-permissions for group # noqa command-instead-of-shell
-  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
+  ansible.builtin.shell: find -L {{ item }} -perm /go+w -type f
  with_community.general.flattened:
-    - '/usr/local/sbin'
+    - /usr/local/sbin
-    - '/usr/local/bin'
+    - /usr/local/bin
-    - '/usr/sbin'
+    - /usr/sbin
-    - '/usr/bin'
+    - /usr/bin
-    - '/sbin'
+    - /sbin
-    - '/bin'
+    - /bin
-    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
+    - "{{ os_env_extra_user_paths }}"
  register: minimize_access_directories
  ignore_errors: true
  changed_when: false
 - name: Minimize access on found files
-  file:
+  ansible.builtin.file:
-    path: '{{ item.1 }}'
+    path: "{{ item.1 }}"
-    mode: 'go-w'
+    mode: go-w
    state: file
  with_subelements:
    - "{{ minimize_access_directories.results }}"
    - stdout_lines
 - name: Find shadow files
-  stat:
+  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
-    - '/etc/shadow'
+    - /etc/shadow
-    - '/etc/gshadow'
+    - /etc/gshadow
-    - '/etc/shadow-'
+    - /etc/shadow-
-    - '/etc/gshadow-'
+    - /etc/gshadow-
  register: minimize_access_shadow_files
 - name: Change shadow ownership to root and mode to 0600 | os-02
-  file:
+  ansible.builtin.file:
    dest: "{{ item.item }}"
-    owner: '{{ os_shadow_perms.owner }}'
+    owner: "{{ os_shadow_perms.owner }}"
-    group: '{{ os_shadow_perms.group }}'
+    group: "{{ os_shadow_perms.group }}"
-    mode: '{{ os_shadow_perms.mode }}'
+    mode: "{{ os_shadow_perms.mode }}"
  when: item.stat.exists
  loop: "{{ minimize_access_shadow_files.results }}"
 - name: Find passwd files
-  stat:
+  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
-    - '/etc/passwd'
+    - /etc/passwd
-    - '/etc/group'
+    - /etc/group
-    - '/etc/passwd-'
+    - /etc/passwd-
-    - '/etc/group-'
+    - /etc/group-
  register: minimize_access_passwd_files
 - name: Change passwd ownership to root and mode to 0644 | os-03
-  file:
+  ansible.builtin.file:
    dest: "{{ item.item }}"
-    owner: '{{ os_passwd_perms.owner }}'
+    owner: "{{ os_passwd_perms.owner }}"
-    group: '{{ os_passwd_perms.group }}'
+    group: "{{ os_passwd_perms.group }}"
-    mode: '{{ os_passwd_perms.mode }}'
+    mode: "{{ os_passwd_perms.mode }}"
  when: item.stat.exists
  loop: "{{ minimize_access_passwd_files.results }}"
 - name: Change su-binary to only be accessible to user and group root
-  file:
+  ansible.builtin.file:
-    dest: '/bin/su'
+    dest: /bin/su
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0750'
+    mode: "0750"
  when: '"change_user" not in os_security_users_allow'
 - name: Set option hidepid for proc filesystem
-  mount:
+  ansible.posix.mount:
    path: /proc
    src: proc
    fstype: proc
-    opts: '{{ proc_mnt_options }}'
+    opts: "{{ proc_mnt_options }}"
    state: mounted
 - name: Generate list of current available mounted filesystems on the system
-  set_fact:
+  ansible.builtin.set_fact:
    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
 - name: Append special devices list to valid mountpoint list
-  set_fact:
+  ansible.builtin.set_fact:
    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
 - name: Minimize access for filesystems
-  include_tasks: minimize_access_fs.yml
+  ansible.builtin.include_tasks: minimize_access_fs.yml
  loop:
    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" }
    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" }
    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" }
    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" }
    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" }
    - { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" }
    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" }
    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" }
    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" }
    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" }
  loop_control:
    loop_var: mount
  loop:
    - path: /boot
      src: "{{ os_mnt_boot_src }}"
      fstype: "{{ os_mnt_boot_filesystem }}"
      opts: "{{ os_mnt_boot_options }}"
      enabled: "{{ os_mnt_boot_enabled }}"
      mode: "{{ os_mnt_boot_dir_mode }}"
      group: "{{ os_mnt_boot_group }}"
      owner: "{{ os_mnt_boot_owner }}"
      dump: "{{ os_mnt_boot_dump }}"
      passno: "{{ os_mnt_boot_passno }}"
    - path: /dev
      src: "{{ os_mnt_dev_src }}"
      fstype: "{{ os_mnt_dev_filesystem }}"
      opts: "{{ os_mnt_dev_options }}"
      enabled: "{{ os_mnt_dev_enabled }}"
      mode: "{{ os_mnt_dev_dir_mode }}"
      group: "{{ os_mnt_dev_group }}"
      owner: "{{ os_mnt_dev_owner }}"
      dump: "{{ os_mnt_dev_dump }}"
      passno: "{{ os_mnt_dev_passno }}"
    - path: /dev/shm
      src: "{{ os_mnt_dev_shm_src }}"
      fstype: "{{ os_mnt_dev_shm_filesystem }}"
      opts: "{{ os_mnt_dev_shm_options }}"
      enabled: "{{ os_mnt_dev_shm_enabled }}"
      mode: "{{ os_mnt_dev_shm_dir_mode }}"
      group: "{{ os_mnt_dev_shm_group }}"
      owner: "{{ os_mnt_dev_shm_owner }}"
      dump: "{{ os_mnt_dev_shm_dump }}"
      passno: "{{ os_mnt_dev_shm_passno }}"
    - path: /home
      src: "{{ os_mnt_home_src }}"
      fstype: "{{ os_mnt_home_filesystem }}"
      opts: "{{ os_mnt_home_options }}"
      enabled: "{{ os_mnt_home_enabled }}"
      mode: "{{ os_mnt_home_dir_mode }}"
      group: "{{ os_mnt_home_group }}"
      owner: "{{ os_mnt_home_owner }}"
      dump: "{{ os_mnt_home_dump }}"
      passno: "{{ os_mnt_home_passno }}"
    - path: /run
      src: "{{ os_mnt_run_src }}"
      fstype: "{{ os_mnt_run_filesystem }}"
      opts: "{{ os_mnt_run_options }}"
      enabled: "{{ os_mnt_run_enabled }}"
      mode: "{{ os_mnt_run_dir_mode }}"
      group: "{{ os_mnt_run_group }}"
      owner: "{{ os_mnt_run_owner }}"
      dump: "{{ os_mnt_run_dump }}"
      passno: "{{ os_mnt_run_passno }}"
    - path: /tmp
      src: "{{ os_mnt_tmp_src }}"
      fstype: "{{ os_mnt_tmp_filesystem }}"
      opts: "{{ os_mnt_tmp_options }}"
      enabled: "{{ os_mnt_tmp_enabled }}"
      mode: "{{ os_mnt_tmp_dir_mode }}"
      group: "{{ os_mnt_tmp_group }}"
      owner: "{{ os_mnt_tmp_owner }}"
      dump: "{{ os_mnt_tmp_dump }}"
      passno: "{{ os_mnt_tmp_passno }}"
    - path: /var
      src: "{{ os_mnt_var_src }}"
      fstype: "{{ os_mnt_var_filesystem }}"
      opts: "{{ os_mnt_var_options }}"
      enabled: "{{ os_mnt_var_enabled }}"
      mode: "{{ os_mnt_var_dir_mode }}"
      group: "{{ os_mnt_var_group }}"
      owner: "{{ os_mnt_var_owner }}"
      dump: "{{ os_mnt_var_dump }}"
      passno: "{{ os_mnt_var_passno }}"
    - path: /var/log
      src: "{{ os_mnt_var_log_src }}"
      fstype: "{{ os_mnt_var_log_filesystem }}"
      opts: "{{ os_mnt_var_log_options }}"
      enabled: "{{ os_mnt_var_log_enabled }}"
      mode: "{{ os_mnt_var_log_dir_mode }}"
      group: "{{ os_mnt_var_log_group }}"
      owner: "{{ os_mnt_var_log_owner }}"
      dump: "{{ os_mnt_var_log_dump }}"
      passno: "{{ os_mnt_var_log_passno }}"
    - path: /var/log/audit
      src: "{{ os_mnt_var_log_audit_src }}"
      fstype: "{{ os_mnt_var_log_audit_filesystem }}"
      opts: "{{ os_mnt_var_log_audit_options }}"
      enabled: "{{ os_mnt_var_log_audit_enabled }}"
      mode: "{{ os_mnt_var_log_audit_dir_mode }}"
      group: "{{ os_mnt_var_log_audit_group }}"
      owner: "{{ os_mnt_var_log_audit_owner }}"
      dump: "{{ os_mnt_var_log_audit_dump }}"
      passno: "{{ os_mnt_var_log_audit_passno }}"
    - path: /var/tmp
      src: "{{ os_mnt_var_tmp_src }}"
      fstype: "{{ os_mnt_var_tmp_filesystem }}"
      opts: "{{ os_mnt_var_tmp_options }}"
      enabled: "{{ os_mnt_var_tmp_enabled }}"
      mode: "{{ os_mnt_var_tmp_dir_mode }}"
      group: "{{ os_mnt_var_tmp_group }}"
      owner: "{{ os_mnt_var_tmp_owner }}"
      dump: "{{ os_mnt_var_tmp_dump }}"
      passno: "{{ os_mnt_var_tmp_passno }}"
@@ -1,6 +1,6 @@
 ---
- name: "Configure mount {{ mount.path }} with hardened options"
+- name: "Configure hardened options for mount {{ mount.path }}"
-  mount:
+  ansible.posix.mount:
    path: "{{ mount.path }}"
    src: "{{ mount.src | default(mountinfo.device, true) }}"
    fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
@@ -16,21 +16,21 @@
    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
  notify: Remount filesystems
- name: "Check if {{ mount.path }} exists"
+- name: "Check for existence of mount {{ mount.path }}"
-  stat:
+  ansible.builtin.stat:
    path: "{{ mount.path }}"
  register: mountpoint_exists
- name: "Harden permissions for {{ mount.path }} directory"
+- name: "Harden permissions for directory of mount {{ mount.path }}"
-  file:
+  ansible.builtin.file:
    dest: "{{ mount.path }}"
-    owner: 'root'
+    owner: "{{ mount.owner }}"
-    group: 'root'
+    group: "{{ mount.group }}"
    mode: "{{ mount.mode }}"
  when:
    - mountpoint_exists.stat.exists | bool
 - name: "Register changed mountpoints"
-  set_fact:
+  ansible.builtin.set_fact:
    mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
  when: mountpoint.changed  # noqa no-handler
@@ -1,29 +1,29 @@
 ---
 - name: Install modprobe to disable filesystems | os-10
-  package:
+  ansible.builtin.package:
-    name: '{{ modprobe_package }}'
+    name: "{{ modprobe_package }}"
-    state: 'present'
+    state: present
 - name: Check if efi is installed
-  stat:
+  ansible.builtin.stat:
-    path: "/sys/firmware/efi"
+    path: /sys/firmware/efi
  register: efi_installed
 - name: Remove vfat from fs-list if efi is used
-  set_fact:
+  ansible.builtin.set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
  when:
    - efi_installed.stat.isdir is defined
    - efi_installed.stat.isdir
 - name: Remove used filesystems from fs-list
-  set_fact:
+  ansible.builtin.set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
 - name: Disable unused filesystems | os-10
-  template:
+  ansible.builtin.template:
-    src: 'etc/modprobe.d/modprobe.j2'
+    src: etc/modprobe.d/modprobe.j2
-    dest: '/etc/modprobe.d/dev-sec.conf'
+    dest: /etc/modprobe.d/dev-sec.conf
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0644'
+    mode: "0644"
@@ -1,13 +1,13 @@
 ---
 - name: Get user accounts | os-09
-  command: "awk -F: '{print $1}' /etc/passwd"
+  ansible.builtin.command: "awk -F: '{print $1}' /etc/passwd"
  changed_when: false
  check_mode: false
  register: users_accounts
 - name: Delete .netrc-files from system | os-09
-  file:
+  ansible.builtin.file:
-    dest: '~{{ item }}/.netrc'
+    dest: ~{{ item }}/.netrc
-    state: 'absent'
+    state: absent
-  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
+  loop: "{{ users_accounts.stdout_lines | flatten | default([]) }}"
  when: item not in os_netrc_whitelist_user
@@ -1,6 +1,6 @@
 ---
 - name: Gather package facts
-  package_facts:
+  ansible.builtin.package_facts:
    manager: auto
  when:
    - ansible_facts.os_family != 'Suse'
@@ -11,27 +11,29 @@
 # normally caching credentials shouldn't be necessary for most machines.
 # removing it provides some more security while not removing usability.
 - name: Remove pam ccreds to disable password caching
-  package:
+  ansible.builtin.package:
-    name: '{{ os_packages_pam_ccreds }}'
+    name: "{{ os_packages_pam_ccreds }}"
-    state: 'absent'
+    state: absent
  when:
    - ansible_facts.os_family != 'Archlinux'
- import_tasks: pam_debian.yml
+- name: Import tasks for Debian PAM
  ansible.builtin.import_tasks: pam_debian.yml
  when:
    - ansible_facts.os_family == 'Debian'
- import_tasks: pam_rhel.yml
+- name: Import tasks for RedHat PAM
  ansible.builtin.import_tasks: pam_rhel.yml
  when:
    - ansible_facts.os_family == 'RedHat'
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-  template:
+  ansible.builtin.template:
-    src: 'etc/libuser.conf.j2'
+    src: etc/libuser.conf.j2
-    dest: '/etc/libuser.conf'
+    dest: /etc/libuser.conf
-    mode: '0640'
+    mode: "0640"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
  when:
    - ansible_facts.os_family != 'Suse'
    - ansible_facts.os_family != 'Archlinux'
@@ -1,120 +1,120 @@
 ---
 - name: Install the package for strong password checking
-  apt:
+  ansible.builtin.apt:
-    name: 'libpam-passwdqc'
+    name: libpam-passwdqc
-    state: 'present'
+    state: present
-    update_cache: 'yes'
+    update_cache: true
  when:
    - os_auth_pam_passwdqc_enable
 - name: Configure passwdqc
-  template:
+  ansible.builtin.template:
-    src: 'usr/share/pam-configs/pam_passwdqc.j2'
+    src: usr/share/pam-configs/pam_passwdqc.j2
-    dest: '{{ passwdqc_path }}'
+    dest: "{{ passwdqc_path }}"
-    mode: '0644'
+    mode: "0644"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
  when:
    - os_auth_pam_passwdqc_enable
 - name: Install tally2
-  apt:
+  ansible.builtin.apt:
-    name: 'libpam-modules'
+    name: libpam-modules
-    state: 'present'
+    state: present
  when:
-    - os_auth_retries > 0
+    - os_auth_retries|int > 0
 - name: Manage tally on Debian stable
  when:
    - "'libpam-modules' in ansible_facts.packages"
    - ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')
  block:
    - name: Configure tally2
-      template:
+      ansible.builtin.template:
-        src: 'usr/share/pam-configs/pam_tally2.j2'
+        src: usr/share/pam-configs/pam_tally2.j2
-        dest: '{{ tally2_path }}'
+        dest: "{{ tally2_path }}"
-        mode: '0644'
+        mode: "0644"
-        owner: 'root'
+        owner: root
-        group: 'root'
+        group: root
      when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
    - name: Delete tally2 when retries is 0
-      file:
+      ansible.builtin.file:
-        path: '{{ tally2_path }}'
+        path: "{{ tally2_path }}"
-        state: 'absent'
+        state: absent
      when:
-        - os_auth_retries == 0
+        - os_auth_retries|int == 0
  when:
    - "'libpam-modules' in ansible_facts.packages"
    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
 - name: Manage tally/faillock on Debian unstable
  block:
    - name: Delete tally2
      file:
        path: '{{ tally2_path }}'
        state: 'absent'
    - name:  create tally directory
      file:
        path: '/var/run/faillock'
        state: 'directory'
        mode: '0755'
        owner: 'root'
        group: 'root'
    - name: Configure faillock
      template:
        src: 'etc/security/faillock.conf.j2'
        dest: '/etc/security/faillock.conf'
        mode: '0644'
        owner: 'root'
        group: 'root'
    - name: Configure faillock pam
      template:
        src: 'usr/share/pam-configs/pam_faillock.j2'
        dest: '/usr/share/pam-configs/faillock'
        mode: '0644'
        owner: 'root'
        group: 'root'
      when:
        - os_auth_retries > 0
    - name: Configure faillock pam authfail
      template:
        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
        dest: '/usr/share/pam-configs/faillock_authfail'
        mode: '0644'
        owner: 'root'
        group: 'root'
      when:
        - os_auth_retries > 0
    - name: Delete faillock when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock'
        state: 'absent'
      when:
        - os_auth_retries == 0
    - name: Delete faillock authfail when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock_authfail'
        state: 'absent'
      when:
        - os_auth_retries == 0
  when:
    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+    - ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')
  block:
    - name: Delete tally2
      ansible.builtin.file:
        path: "{{ tally2_path }}"
        state: absent
    - name: Create tally directory
      ansible.builtin.file:
        path: /var/run/faillock
        state: directory
        mode: "0755"
        owner: root
        group: root
    - name: Configure faillock
      ansible.builtin.template:
        src: etc/security/faillock.conf.j2
        dest: /etc/security/faillock.conf
        mode: "0644"
        owner: root
        group: root
    - name: Configure faillock pam
      ansible.builtin.template:
        src: usr/share/pam-configs/pam_faillock.j2
        dest: /usr/share/pam-configs/faillock
        mode: "0644"
        owner: root
        group: root
      when:
        - os_auth_retries|int > 0
    - name: Configure faillock pam authfail
      ansible.builtin.template:
        src: usr/share/pam-configs/pam_faillock_authfail.j2
        dest: /usr/share/pam-configs/faillock_authfail
        mode: "0644"
        owner: root
        group: root
      when:
        - os_auth_retries|int > 0
    - name: Delete faillock when retries is 0
      ansible.builtin.file:
        path: /usr/share/pam-configs/faillock
        state: absent
      when:
        - os_auth_retries|int == 0
    - name: Delete faillock authfail when retries is 0
      ansible.builtin.file:
        path: /usr/share/pam-configs/faillock_authfail
        state: absent
      when:
        - os_auth_retries|int == 0
 - name: Update pam on Debian systems
-  command: 'pam-auth-update --package'
+  ansible.builtin.command: pam-auth-update --package
  environment:
    DEBIAN_FRONTEND: noninteractive
  changed_when: false
 - name: Remove passwdqc
-  apt:
+  ansible.builtin.apt:
-    name: 'libpam-passwdqc'
+    name: libpam-passwdqc
-    state: 'absent'
+    state: absent
  when:
    - not os_auth_pam_passwdqc_enable
@@ -1,43 +1,43 @@
 ---
 - name: Install sssd-clients
-  yum:
+  ansible.builtin.yum:
    name: sssd-client
-    state: 'present'
+    state: present
  when:
    - os_auth_pam_sssd_enable | bool
 - name: Configure passwdqc and faillock via central system-auth config
-  template:
+  ansible.builtin.template:
-    src: 'etc/pam.d/rhel_auth.j2'
+    src: etc/pam.d/rhel_auth.j2
-    dest: '/etc/pam.d/system-auth-local'
+    dest: /etc/pam.d/system-auth-local
-    mode: '0640'
+    mode: "0640"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
 - name: Enable our config for system-auth
-  file:
+  ansible.builtin.file:
    src: /etc/pam.d/system-auth-local
    dest: /etc/pam.d/system-auth
-    mode: '0640'
+    mode: "0640"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
    state: link
    force: true
 - name: Configure passwdqc and faillock via central password-auth config
-  template:
+  ansible.builtin.template:
-    src: 'etc/pam.d/rhel_auth.j2'
+    src: etc/pam.d/rhel_auth.j2
-    dest: '/etc/pam.d/password-auth-local'
+    dest: /etc/pam.d/password-auth-local
-    mode: '0640'
+    mode: "0640"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
 - name: Enable our config for password-auth
-  file:
+  ansible.builtin.file:
    src: /etc/pam.d/password-auth-local
    dest: /etc/pam.d/password-auth
-    mode: '0640'
+    mode: "0640"
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
    state: link
    force: true
@@ -1,23 +1,23 @@
 ---
 - name: Add pinerolo_profile.sh to profile.d
-  template:
+  ansible.builtin.template:
-    src: 'etc/profile.d/profile.conf.j2'
+    src: etc/profile.d/profile.conf.j2
-    dest: '/etc/profile.d/pinerolo_profile.sh'
+    dest: /etc/profile.d/pinerolo_profile.sh
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0750'
+    mode: "0750"
  when: not os_security_kernel_enable_core_dump | bool
 - name: Remove pinerolo_profile.sh from profile.d
-  file:
+  ansible.builtin.file:
    path: /etc/profile.d/pinerolo_profile.sh
    state: absent
  when: os_security_kernel_enable_core_dump | bool
 - name: Add autologout to profile env
-  template:
+  ansible.builtin.template:
-    src: 'etc/profile.d/tmout.sh.j2'
+    src: etc/profile.d/tmout.sh.j2
-    dest: '/etc/profile.d/tmout.sh'
+    dest: /etc/profile.d/tmout.sh
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0644'
+    mode: "0644"
@@ -1,17 +1,17 @@
 ---
 - name: Get user accounts | os-09
-  command: "awk -F: '{print $1}' /etc/passwd"
+  ansible.builtin.command: "awk -F: '{print $1}' /etc/passwd"
  changed_when: false
  check_mode: false
  register: users_accounts
 - name: Delete rhosts-files from system | os-09
-  file:
+  ansible.builtin.file:
-    dest: '~{{ item }}/.rhosts'
+    dest: ~{{ item }}/.rhosts
-    state: 'absent'
+    state: absent
-  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
+  loop: "{{ users_accounts.stdout_lines | flatten | default([]) }}"
 - name: Delete hosts.equiv from system | os-01
-  file:
+  ansible.builtin.file:
-    dest: '/etc/hosts.equiv'
+    dest: /etc/hosts.equiv
-    state: 'absent'
+    state: absent
@@ -1,8 +1,8 @@
 ---
 - name: Create securetty
-  template:
+  ansible.builtin.template:
-    src: 'etc/securetty.j2'
+    src: etc/securetty.j2
-    dest: '/etc/securetty'
+    dest: /etc/securetty
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0400'
+    mode: "0400"
@@ -1,5 +1,5 @@
 ---
 - name: Configure selinux | selinux-01
-  selinux:
+  ansible.posix.selinux:
    policy: "{{ os_selinux_policy }}"
-    state: "{{ os_selinux_state }}"
+    state: "{{ os_selinux_state }}" # noqa args - see https://github.com/ansible/ansible-lint/issues/2930
@@ -1,32 +1,32 @@
 ---
 - name: Remove suid/sgid bit from binaries in blacklist | os-06
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
-    mode: 'a-s'
+    mode: a-s
-    state: 'file'
+    state: file
-    follow: 'yes'
+    follow: true
  failed_when: false
  with_community.general.flattened:
-    - '{{ os_security_suid_sgid_system_blacklist }}'
+    - "{{ os_security_suid_sgid_system_blacklist }}"
-    - '{{ os_security_suid_sgid_blacklist }}'
+    - "{{ os_security_suid_sgid_blacklist }}"
 - name: Find binaries with suid/sgid set | os-06
-  shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
+  ansible.builtin.shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
  register: sbit_binaries
  when: os_security_suid_sgid_remove_from_unknown | bool
  changed_when: false
 - name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
-  set_fact:
+  ansible.builtin.set_fact:
-    suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
+    suid: "{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}"
  when: os_security_suid_sgid_remove_from_unknown | bool
 - name: Remove suid/sgid bit from all binaries except in system and user whitelist | os-06
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
-    mode: 'a-s'
+    mode: a-s
-    state: 'file'
+    state: file
-    follow: 'yes'
+    follow: true
  with_community.general.flattened:
-    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
+    - "{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}"
  when: os_security_suid_sgid_remove_from_unknown | bool
@@ -1,39 +1,39 @@
 ---
 - name: Protect sysctl.conf
-  file:
+  ansible.builtin.file:
-    path: '/etc/sysctl.conf'
+    path: /etc/sysctl.conf
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0440'
+    mode: "0440"
    state: touch
    modification_time: preserve
    access_time: preserve
 - name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
-  template:
+  ansible.builtin.template:
-    src: 'etc/sysconfig/rhel_sysconfig_init.j2'
+    src: etc/sysconfig/rhel_sysconfig_init.j2
-    dest: '/etc/sysconfig/init'
+    dest: /etc/sysconfig/init
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0544'
+    mode: "0544"
  when: ansible_facts.os_family == 'RedHat'
 - name: Install initramfs-tools
-  apt:
+  ansible.builtin.apt:
-    name: 'initramfs-tools'
+    name: initramfs-tools
-    state: 'present'
+    state: present
    update_cache: true
  when:
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading
 - name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
-  template:
+  ansible.builtin.template:
-    src: 'etc/initramfs-tools/modules.j2'
+    src: etc/initramfs-tools/modules.j2
-    dest: '/etc/initramfs-tools/modules'
+    dest: /etc/initramfs-tools/modules
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0440'
+    mode: "0440"
  notify:
    - Update-initramfs
  when:
@@ -42,40 +42,40 @@
  register: initramfs
 - name: Change sysctls
  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
  block:
    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      set_fact:
+      ansible.builtin.set_fact:
-        sysctl_config: '{{ sysctl_config | combine(sysctl_custom_config) }}'
+        sysctl_config: "{{ sysctl_config | combine(sysctl_custom_config) }}"
      when: sysctl_custom_config | default()
    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      set_fact:
+      ansible.builtin.set_fact:
-        sysctl_config: '{{ sysctl_config | combine(sysctl_rhel_config) }}'
+        sysctl_config: "{{ sysctl_config | combine(sysctl_rhel_config) }}"
      when: sysctl_rhel_config | default()
    - name: Create a combined sysctl-dict if overwrites are defined
-      set_fact:
+      ansible.builtin.set_fact:
-        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
+        sysctl_config: "{{ sysctl_config | combine(sysctl_overwrite) }}"
      when: sysctl_overwrite | default()
    - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
-      sysctl:
+      ansible.posix.sysctl:
-        name: '{{ item.key }}'
+        name: "{{ item.key }}"
-        value: '{{ item.value }}'
+        value: "{{ item.value }}"
        sysctl_set: true
        state: present
        reload: true
        ignoreerrors: true
-      with_dict: '{{ sysctl_config }}'
+      with_dict: "{{ sysctl_config }}"
      when: item.key not in sysctl_unsupported_entries | default()
  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 - name: Apply ufw defaults
-  template:
+  ansible.builtin.template:
-    src: 'etc/default/ufw.j2'
+    src: etc/default/ufw.j2
-    dest: '/etc/default/ufw'
+    dest: /etc/default/ufw
-    mode: '0644'
+    mode: "0644"
  when:
    - ufw_manage_defaults
    - ansible_facts.os_family == 'Debian'
@@ -1,64 +1,109 @@
 ---
- name: Get UID_MIN from login.defs
+- name: Read local linux user database
-  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
+  ansible.builtin.getent:
-  args:
+    database: passwd
-    removes: /etc/login.defs
+    # creates a dict for each user containing UID/HOMEDIR etc...
-  register: uid_min
+  when: getent_passwd is undefined # skip this task if "getent" has run before
  check_mode: false
  changed_when: false
- name: Calculate UID_MAX from UID_MIN by substracting 1
+- name: Read local linux shadow database
-  set_fact:
+  ansible.builtin.getent:
-    uid_max: '{{ uid_min.stdout | int - 1 }}'
+    database: shadow
  when: uid_min.stdout|int > 0
- name: Set UID_MAX on Debian-systems if no login.defs exist
+- name: Extract system accounts from local user database
-  set_fact:
+  loop: "{{ getent_passwd.keys() | list }}"
    uid_max: '999'
  when:
-    - ansible_facts.os_family == 'Debian'
+    - getent_passwd[item][1]|int > 0
-    - uid_max is not defined
+    - getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
    - item is not in os_always_ignore_users     # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users            # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
    system_users: "{{ system_users | default([]) + [item] }}"
- name: Set UID_MAX on other systems if no login.defs exist
+- name: Extract regular (non-system, non-root) accounts from local user database
-  set_fact:
+  loop: "{{ getent_passwd.keys() | list }}"
-    uid_max: '499'
+  when:
-  when: uid_max is not defined
+    - getent_passwd[item][1]|int >= os_auth_uid_min|int
    - getent_passwd[item][1]|int <= os_auth_uid_max|int
    - item is not in os_always_ignore_users # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
    regular_users: "{{ regular_users | default([]) + [item] }}"
- name: Get all system accounts
+- name: Set password ageing for existing regular (non-system, non-root) accounts
-  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
+  ansible.builtin.user:
-  args:
+    name: "{{ item }}"
-    removes: /etc/passwd
+    password_expire_min: "{{ os_auth_pw_min_age }}"
-  changed_when: false
+    password_expire_max: "{{ os_auth_pw_max_age }}"
-  check_mode: false
+  loop: "{{ regular_users }}"
-  register: sys_accs
+  when:
    - os_user_pw_ageing
    - regular_users is defined and (regular_users | length > 0)
    - item not in os_users_without_password_ageing
    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
- name: Remove always ignored system accounts from list
+- name: Extract root account(s) from local user database
-  set_fact:
+  loop: "{{ getent_passwd.keys() | list }}"
-    sys_accs_cond: '{{ sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
+  when:
-  check_mode: false
+    - getent_passwd[item][1]|int == 0
  ansible.builtin.set_fact:
    root_users: "{{ root_users | default([]) + [item] }}"
- name: Change system accounts not on the user provided ignore-list
+- name: Set ownership of root user home directory(s) to 0700
-  user:
+  ansible.builtin.file:
    mode: 0700
    owner: "{{ item }}"
    path: "{{ getent_passwd[item][4] }}"
    state: directory
  loop: "{{ root_users }}"
  when:
    - os_chmod_rootuser_home_folder | bool
 - name: Set password ageing for root user(s)
  ansible.builtin.user:
    name: "{{ item }}"
    password_expire_min: "{{ os_auth_pw_min_age }}"
    password_expire_max: "{{ os_auth_pw_max_age }}"
  loop: "{{ root_users }}"
  when:
    - os_rootuser_pw_ageing | bool
    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
 - name: Remove additional users with UID=0 ("root" user is not touched)
  ansible.builtin.user:
    name: "{{ item }}"
    state: absent
  loop: "{{ root_users }}"
  when:
    - os_remove_additional_root_users|bool
    - root_users|length > 1
    - item != "root"
 - name: Remove shell for linux system accounts
  ansible.builtin.user:
    name: '{{ item }}'
    shell: '{{ os_nologin_shell_path }}'
    createhome: false
  loop: "{{ system_users }}"
 - name: Lock passwords from linux system accounts
  ansible.builtin.user:
    name: '{{ item }}'
    password: '*'
    createhome: false
-  with_community.general.flattened:
+  loop: "{{ system_users }}"
-    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
+  when:
    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
- name: get all home directories in /home, but skip ignored users
+- name: Limit access to home directories of regular (non-system, non-root) accounts
-  find:
+  ansible.builtin.file:
    paths: /home/
    recurse: false
    file_type: directory
    excludes: "{{ os_ignore_home_folder_users | join(',') }}"
  register: home_directories
  when: os_chmod_home_folders | bool
 - name: set ownership of /home directories to 0700
  file:
    mode: 0700
-    path: "{{ item.path }}"
+    owner: "{{ item }}"
    path: "{{ getent_passwd[item][4] }}"
    state: directory
-  loop: "{{ home_directories.files }}"
+  loop: "{{ regular_users }}"
-  when: os_chmod_home_folders | bool
+  when:
    - os_chmod_home_folders | bool
    - regular_users is defined and (regular_users | length > 0)
    - item not in os_ignore_home_folder_users | default([])
@@ -1,50 +1,51 @@
 ---
 - name: Remove unused repositories
-  file:
+  ansible.builtin.file:
-    name: '/etc/yum.repos.d/{{ item }}.repo'
+    name: /etc/yum.repos.d/{{ item }}.repo
-    state: 'absent'
+    state: absent
  loop:
-    - 'CentOS-Debuginfo'
+    - CentOS-Debuginfo
-    - 'CentOS-Media'
+    - CentOS-Media
-    - 'CentOS-Vault'
+    - CentOS-Vault
  when: os_security_packages_clean | bool
 - name: Get yum repository files
-  find:
+  ansible.builtin.find:
-    paths: '/etc/yum.repos.d'
+    paths: /etc/yum.repos.d
-    patterns: '*.repo'
+    patterns: "*.repo"
  register: yum_repos
 # for the 'default([])' see here:
 # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
 # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
 - name: Activate gpg-check for yum repository files
-  replace:
+  ansible.builtin.replace:
-    path: '{{ item }}'
+    path: "{{ item }}"
-    regexp: '^\s*gpgcheck.*'
+    regexp: ^\s*gpgcheck.*
-    replace: 'gpgcheck=1'
+    replace: gpgcheck=1
-    mode: '0644'
+    mode: "0644"
  with_items:
    # yamllint disable-line rule:line-length
    - "{{ yum_repos.files | default([]) | map(attribute='path') | difference(os_yum_repo_file_whitelist | map('regex_replace', '^', '/etc/yum.repos.d/') | list) }}"
 # failed_when is needed because by default replace module will fail if the file doesn't exists.
 # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
 # All other errors will still be raised.
 - name: Activate gpg-check for config files
-  replace:
+  ansible.builtin.replace:
-    path: '{{ item }}'
+    path: "{{ item }}"
-    regexp: '^\s*gpgcheck\W.*'
+    regexp: ^\s*gpgcheck\W.*
-    replace: 'gpgcheck=1'
+    replace: gpgcheck=1
-    mode: '0644'
+    mode: "0644"
  register: status
  failed_when: status.rc is defined and status.rc not in (257, 0)
  loop:
-    - '/etc/yum.conf'
+    - /etc/yum.conf
-    - '/etc/dnf/dnf.conf'
+    - /etc/dnf/dnf.conf
-    - '/etc/yum/pluginconf.d/rhnplugin.conf'
+    - /etc/yum/pluginconf.d/rhnplugin.conf
 - name: Remove deprecated or insecure packages | package-01 - package-09
-  yum:
+  ansible.builtin.yum:
-    name: '{{ os_security_packages_list }}'
+    name: "{{ os_security_packages_list }}"
-    state: 'absent'
+    state: absent
  when: os_security_packages_clean | bool
@@ -2,30 +2,26 @@
 # Generated by Ansible role {{ ansible_role_name }}
 log_file = /var/log/audit/audit.log
-log_format = RAW
+log_format = {{ os_auditd_log_format }}
-log_group = root
+log_group = {{ os_auditd_log_group }}
 priority_boost = 4
-flush = INCREMENTAL
+flush = {{ os_auditd_flush }}
 freq = 20
-num_logs = 5
+num_logs = {{ os_auditd_num_logs }}
 disp_qos = lossy
 dispatcher = /sbin/audispd
 name_format = NONE
 ##name = mydomain
 max_log_file = {{ os_auditd_max_log_file }}
 max_log_file_action = {{ os_auditd_max_log_file_action }}
-space_left = 75
+space_left = {{ os_auditd_space_left }}
-space_left_action = SYSLOG
+space_left_action = {{ os_auditd_space_left_action }}
 action_mail_acct = root
-admin_space_left = 50
+admin_space_left = {{ os_auditd_admin_space_left }}
-admin_space_left_action = SUSPEND
+admin_space_left_action = {{ os_auditd_admin_space_left_action }}
-disk_full_action = SUSPEND
+disk_full_action = {{ os_auditd_disk_full_action }}
-disk_error_action = SUSPEND
+disk_error_action = {{ os_auditd_disk_error_action }}
 ##tcp_listen_port =
 tcp_listen_queue = 5
 tcp_max_per_addr = 1
 ##tcp_client_ports = 1024-65535
 tcp_client_max_idle = 0
 enable_krb5 = no
 krb5_principal = auditd
 ##krb5_key_file = /etc/audit/audit.key
@@ -110,7 +110,7 @@ PASS_MAX_DAYS     {{ os_auth_pw_max_age }}
 PASS_MIN_DAYS     {{ os_auth_pw_min_age }}
 # Number of days warning given before a password expires.
-PASS_WARN_AGE     7
+PASS_WARN_AGE     {{ os_auth_pw_warn_age }}
 # Min/max values for automatic uid selection in useradd
 UID_MIN           {{ os_auth_uid_min }}
@@ -4,7 +4,7 @@
 #%PAM-1.0
 auth        required      pam_env.so
 auth        required      pam_faildelay.so delay=2000000
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -16,12 +16,12 @@ auth        sufficient    pam_unix.so nullok try_first_pass
 auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
 auth        sufficient    pam_sss.so forward_pass
 {% endif %}
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_deny.so
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
 account     required      pam_unix.so
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: pam_ccreds
-os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: root
-  mode: '0000'
+  mode: "0000"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '077'
+os_env_umask: "077"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -35,14 +34,53 @@ os_auth_sub_gid_count: 65536
 os_auth_pam_sssd_enable: false
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true
-modprobe_package: 'module-init-tools'
+modprobe_package: module-init-tools
-auditd_package: 'audit'
+auditd_package: audit
 # system accounts that do not get their login disabled and pasword changed
-os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
+os_always_ignore_users: [root, sync, shutdown, halt, ec2-user]
-
+hidepid_option: "2" # allowed values: 0, 1, 2
 hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,18 +1,17 @@
 ---
-
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: root
-  mode: '0600'
+  mode: "0600"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '027'
+os_env_umask: "027"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -29,10 +28,50 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
-modprobe_package: 'kmod'
+os_mnt_boot_dir_mode: '0700'
-auditd_package: 'audit'
+os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
-hidepid_option: '2'  # allowed values: 0, 1, 2
+os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 modprobe_package: kmod
 auditd_package: audit
 hidepid_option: "2" # allowed values: 0, 1, 2
 sysctl_custom_config:
  # Mitigation of vulnerability CVE-2021-33909
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: libpam-ccreds
-os_packages_pam_ccreds: 'libpam-ccreds'
+os_nologin_shell_path: /usr/sbin/nologin
 os_nologin_shell_path: '/usr/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/usr/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: shadow
-  mode: '0640'
+  mode: "0640"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '027'
+os_env_umask: "027"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -33,16 +32,56 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/mail
-modprobe_package: 'kmod'
+modprobe_package: kmod
-auditd_package: 'auditd'
+auditd_package: auditd
-tally2_path: '/usr/share/pam-configs/tally2'
+tally2_path: /usr/share/pam-configs/tally2
-passwdqc_path: '/usr/share/pam-configs/passwdqc'
+passwdqc_path: /usr/share/pam-configs/passwdqc
-hidepid_option: '2'  # allowed values: 0, 1, 2
+hidepid_option: "2" # allowed values: 0, 1, 2
 sysctl_custom_config:
  # Mitigation of vulnerability CVE-2021-33909
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: pam_ccreds
-os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: root
-  mode: '0000'
+  mode: "0000"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '027'
+os_env_umask: "027"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -35,11 +34,51 @@ os_auth_sub_gid_count: 65536
 os_auth_pam_sssd_enable: true
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true
-modprobe_package: 'module-init-tools'
+modprobe_package: module-init-tools
-auditd_package: 'audit'
+auditd_package: audit
-hidepid_option: '2'  # allowed values: 0, 1, 2
+hidepid_option: "2" # allowed values: 0, 1, 2
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: pam_ccreds
-os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: root
-  mode: '0000'
+  mode: "0000"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '077'
+os_env_umask: "077"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -35,11 +34,51 @@ os_auth_sub_gid_count: 65536
 os_auth_pam_sssd_enable: true
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true
-modprobe_package: 'module-init-tools'
+modprobe_package: module-init-tools
-auditd_package: 'audit'
+auditd_package: audit
-hidepid_option: '2'  # allowed values: 0, 1, 2
+hidepid_option: "2" # allowed values: 0, 1, 2
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: pam_ccreds
-os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: root
-  mode: '0000'
+  mode: "0000"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '077'
+os_env_umask: "077"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -35,15 +34,55 @@ os_auth_sub_gid_count: 65536
 os_auth_pam_sssd_enable: false
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true
-modprobe_package: 'module-init-tools'
+modprobe_package: module-init-tools
-auditd_package: 'audit'
+auditd_package: audit
-hidepid_option: '0'  # allowed values: 0, 1, 2
+hidepid_option: "0" # allowed values: 0, 1, 2
 sysctl_unsupported_entries:
-  - 'fs.protected_fifos'
+  - fs.protected_fifos
-  - 'fs.protected_regular'
+  - fs.protected_regular
@@ -1,7 +1,6 @@
 ---
-
+os_packages_pam_ccreds: pam_ccreds
-os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: /sbin/nologin
 os_nologin_shell_path: '/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
@@ -9,14 +8,14 @@ os_nologin_shell_path: '/sbin/nologin'
 os_shadow_perms:
  owner: root
  group: shadow
-  mode: '0640'
+  mode: "0640"
 os_passwd_perms:
  owner: root
  group: root
-  mode: '0644'
+  mode: "0644"
-os_env_umask: '027'
+os_env_umask: "027"
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
@@ -33,10 +32,50 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_group: 'root'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_create_home: false
-modprobe_package: 'kmod-compat'
+modprobe_package: kmod-compat
-auditd_package: 'audit'
+auditd_package: audit
-hidepid_option: '2'  # allowed values: 0, 1, 2
+hidepid_option: "2" # allowed values: 0, 1, 2
@@ -0,0 +1,91 @@
 ---
 os_packages_pam_ccreds: 'libpam-ccreds'
 os_nologin_shell_path: '/usr/sbin/nologin'
 # Different distros use different standards for /etc/shadow perms, e.g.
 # RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
  owner: root
  group: shadow
  mode: '0640'
 os_passwd_perms:
  owner: root
  group: root
  mode: '0644'
 os_env_umask: '027'
 os_auth_uid_min: 1000
 os_auth_uid_max: 60000
 os_auth_gid_min: 1000
 os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 999
 os_auth_sub_uid_min: 100000
 os_auth_sub_uid_max: 600100000
 os_auth_sub_uid_count: 65536
 os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
 os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_group: 'root'
 os_mnt_boot_owner: 'root'
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_group: 'root'
 os_mnt_dev_owner: 'root'
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_group: 'root'
 os_mnt_dev_shm_owner: 'root'
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_group: 'root'
 os_mnt_home_owner: 'root'
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_group: 'root'
 os_mnt_run_owner: 'root'
 os_mnt_tmp_dir_mode: '1777'
 os_mnt_tmp_group: 'root'
 os_mnt_tmp_owner: 'root'
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_group: 'root'
 os_mnt_var_owner: 'root'
 os_mnt_var_log_dir_mode: '0775'
 os_mnt_var_log_group: 'syslog'
 os_mnt_var_log_owner: 'root'
 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_group: 'root'
 os_mnt_var_log_audit_owner: 'root'
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_group: 'root'
 os_mnt_var_tmp_owner: 'root'
 # defaults for useradd
 os_useradd_mail_dir: /var/mail
 modprobe_package: 'kmod'
 auditd_package: 'auditd'
 tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 hidepid_option: '2'  # allowed values: 0, 1, 2
 sysctl_custom_config:
  # Mitigation of vulnerability CVE-2021-33909
  kernel.unprivileged_userns_clone: 0
  # Mitigation of vulnerability CVE-2021-33910
  kernel.unprivileged_bpf_disabled: 1
@@ -11,102 +11,102 @@
 # list of suid/sgid entries that must be removed
 os_security_suid_sgid_system_blacklist:
  # blacklist as provided by NSA
-  - '/usr/bin/rcp'
+  - /usr/bin/rcp
-  - '/usr/bin/rlogin'
+  - /usr/bin/rlogin
-  - '/usr/bin/rsh'
+  - /usr/bin/rsh
  # sshd must not use host-based authentication (see ssh cookbook)
-  - '/usr/libexec/openssh/ssh-keysign'
+  - /usr/libexec/openssh/ssh-keysign
-  - '/usr/lib/openssh/ssh-keysign'
+  - /usr/lib/openssh/ssh-keysign
  # misc others
-  - '/sbin/netreport'                                            # not normally required for user
+  - /sbin/netreport # not normally required for user
-  - '/usr/sbin/usernetctl'                                       # modify interfaces via functional accounts
+  - /usr/sbin/usernetctl # modify interfaces via functional accounts
  # connecting to ...
-  - '/usr/sbin/userisdnctl'                                      # no isdn...
+  - /usr/sbin/userisdnctl # no isdn...
-  - '/usr/sbin/pppd'                                             # no ppp / dsl ...
+  - /usr/sbin/pppd # no ppp / dsl ...
  # lockfile
-  - '/usr/bin/lockfile'
+  - /usr/bin/lockfile
-  - '/usr/bin/mail-lock'
+  - /usr/bin/mail-lock
-  - '/usr/bin/mail-unlock'
+  - /usr/bin/mail-unlock
-  - '/usr/bin/mail-touchlock'
+  - /usr/bin/mail-touchlock
-  - '/usr/bin/dotlockfile'
+  - /usr/bin/dotlockfile
  # need more investigation blacklist for now
-  - '/usr/bin/arping'
+  - /usr/bin/arping
-  - '/usr/sbin/uuidd'
+  - /usr/sbin/uuidd
-  - '/usr/bin/mtr'                                               # investigate current state...
+  - /usr/bin/mtr # investigate current state...
-  - '/usr/lib/evolution/camel-lock-helper-1.2'                   # investigate current state...
+  - /usr/lib/evolution/camel-lock-helper-1.2 # investigate current state...
-  - '/usr/lib/pt_chown'                                          # pseudo-tty needed?
+  - /usr/lib/pt_chown # pseudo-tty needed?
-  - '/usr/lib/eject/dmcrypt-get-device'
+  - /usr/lib/eject/dmcrypt-get-device
-  - '/usr/lib/mc/cons.saver'                                      # midnight commander screensaver
+  - /usr/lib/mc/cons.saver # midnight commander screensaver
 # list of suid/sgid entries that can remain untouched
 os_security_suid_sgid_system_whitelist:
  # whitelist as provided by NSA
-  - '/bin/mount'
+  - /bin/mount
-  - '/bin/ping'
+  - /bin/ping
-  - '/bin/su'
+  - /bin/su
-  - '/usr/bin/su'
+  - /usr/bin/su
-  - '/bin/umount'
+  - /bin/umount
-  - '/sbin/pam_timestamp_check'
+  - /sbin/pam_timestamp_check
-  - '/sbin/unix_chkpwd'
+  - /sbin/unix_chkpwd
-  - '/usr/bin/at'
+  - /usr/bin/at
-  - '/usr/bin/gpasswd'
+  - /usr/bin/gpasswd
-  - '/usr/bin/locate'
+  - /usr/bin/locate
-  - '/usr/bin/newgrp'
+  - /usr/bin/newgrp
-  - '/usr/bin/passwd'
+  - /usr/bin/passwd
-  - '/usr/bin/ssh-agent'
+  - /usr/bin/ssh-agent
-  - '/usr/libexec/utempter/utempter'
+  - /usr/libexec/utempter/utempter
-  - '/usr/sbin/lockdev'
+  - /usr/sbin/lockdev
-  - '/usr/sbin/sendmail.sendmail'
+  - /usr/sbin/sendmail.sendmail
-  - '/usr/bin/expiry'
+  - /usr/bin/expiry
  # whitelist ipv6
-  - '/bin/ping6'
+  - /bin/ping6
-  - '/usr/bin/traceroute6.iputils'
+  - /usr/bin/traceroute6.iputils
  # whitelist nfs
-  - '/sbin/mount.nfs'
+  - /sbin/mount.nfs
-  - '/sbin/umount.nfs'
+  - /sbin/umount.nfs
  # whitelist nfs4
-  - '/sbin/mount.nfs4'
+  - /sbin/mount.nfs4
-  - '/sbin/umount.nfs4'
+  - /sbin/umount.nfs4
  # whitelist cron
-  - '/usr/bin/crontab'
+  - /usr/bin/crontab
  # whitelist consolemssaging
-  - '/usr/bin/wall'
+  - /usr/bin/wall
-  - '/usr/bin/write'
+  - /usr/bin/write
  # whitelist: only SGID with utmp group for multi-session access
  # impact is limited; installation/usage has some remaining risk
-  - '/usr/bin/screen'
+  - /usr/bin/screen
  # whitelist locate
-  - '/usr/bin/mlocate'
+  - /usr/bin/mlocate
  # whitelist usermanagement
-  - '/usr/bin/chage'
+  - /usr/bin/chage
-  - '/usr/bin/chfn'
+  - /usr/bin/chfn
-  - '/usr/bin/chsh'
+  - /usr/bin/chsh
  # whitelist fuse
-  - '/bin/fusermount'
+  - /bin/fusermount
  # whitelist pkexec
-  - '/usr/bin/pkexec'
+  - /usr/bin/pkexec
  # whitelist sudo
-  - '/usr/bin/sudo'
+  - /usr/bin/sudo
-  - '/usr/bin/sudoedit'
+  - /usr/bin/sudoedit
  # whitelist postfix
-  - '/usr/sbin/postdrop'
+  - /usr/sbin/postdrop
-  - '/usr/sbin/postqueue'
+  - /usr/sbin/postqueue
  # whitelist apache
-  - '/usr/sbin/suexec'
+  - /usr/sbin/suexec
  # whitelist squid
-  - '/usr/lib/squid/ncsa_auth'
+  - /usr/lib/squid/ncsa_auth
-  - '/usr/lib/squid/pam_auth'
+  - /usr/lib/squid/pam_auth
  # whitelist kerberos
-  - '/usr/kerberos/bin/ksu'
+  - /usr/kerberos/bin/ksu
  # whitelist pam_caching
-  - '/usr/sbin/ccreds_validate'
+  - /usr/sbin/ccreds_validate
  # whitelist Xorg
-  - '/usr/bin/Xorg'                                              # xorg
+  - /usr/bin/Xorg # xorg
-  - '/usr/bin/X'                                                 # xorg
+  - /usr/bin/X # xorg
-  - '/usr/lib/dbus-1.0/dbus-daemon-launch-helper'                # freedesktop ipc
+  - /usr/lib/dbus-1.0/dbus-daemon-launch-helper # freedesktop ipc
-  - '/usr/lib/vte/gnome-pty-helper'                              # gnome
+  - /usr/lib/vte/gnome-pty-helper # gnome
-  - '/usr/lib/libvte9/gnome-pty-helper'                          # gnome
+  - /usr/lib/libvte9/gnome-pty-helper # gnome
-  - '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome
+  - /usr/lib/libvte-2.90-9/gnome-pty-helper # gnome
 # system accounts that do not get their login disabled and pasword changed
-os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt']
+os_always_ignore_users: [root, sync, shutdown, halt]
Author	SHA1	Message	Date
schurzi	0705a9cc90	Merge pull request #628 from Normo/add-password-warn-age-option Set number of warning days before user password expires	2023-02-04 18:21:52 +01:00
Norman Ziegner	c594a1fe6a	os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age Signed-off-by: Norman Ziegner <[email protected]>	2023-02-03 14:47:27 +01:00
Norman Ziegner	2f60b44cca	os_hardening: Add variable to set the number of days of warning before user password expires Signed-off-by: Norman Ziegner <[email protected]>	2023-02-01 16:17:36 +01:00
dev-sec CI	1b1b0e10f2	update changelog	2023-02-01 11:40:40 +00:00
dependabot[bot]	f34f24deb7	Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 (#627 ) Bumps [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) from 1.0.0 to 1.0.1. - [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases) - [Commits](https://github.com/hugo19941994/delete-draft-releases/compare/v1.0.0...v1.0.1) --- updated-dependencies: - dependency-name: hugo19941994/delete-draft-releases dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-02-01 12:37:31 +01:00
dev-sec CI	6ccdaee45d	update galaxy.yml with new version	2023-01-31 06:55:37 +00:00
dev-sec CI	e8d16766ad	update changelog	2023-01-31 06:48:47 +00:00
schurzi	e6bc422f5b	Merge pull request #626 from dev-sec/dependabot_labels do not let dependabot label our prs	2023-01-30 16:21:11 +01:00
Sebastian Gumprich	bfedba6907	do not let dependabot label our prs Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-30 16:20:35 +01:00
dev-sec CI	1fe0677b0b	update changelog	2023-01-30 14:59:08 +00:00
schurzi	894c6117a0	Merge pull request #625 from dev-sec/linting_roles run linting only when files inside roles change	2023-01-30 10:48:22 +01:00
Sebastian Gumprich	330a1eb94d	run linting only when files inside roles change Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-30 10:23:25 +01:00
dev-sec CI	52d08ff009	update changelog	2023-01-29 12:39:47 +00:00
dev-sec CI	01cb20d644	update changelog	2023-01-28 21:01:52 +00:00
rndmh3ro	bc096e58e5	Prettified Code!	2023-01-28 20:59:35 +00:00
DonEstefan schurzi donestefan Sebastian Gumprich Sebastian Gumprich	16e00b02db	rewrite user home dir hardening (#584 ) * rewrite user home dir hardening * delete duplicate var that was missed in a merge conflict Signed-off-by: Sebastian Gumprich <[email protected]> * linting Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for home rewrites Signed-off-by: Sebastian Gumprich <[email protected]> * Apply suggestions from code review Co-authored-by: schurzi <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: schurzi <[email protected]>	2023-01-28 21:59:19 +01:00
Sebastian Gumprich	a75b339526	fix more linting errors Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-27 11:27:35 +01:00
dev-sec CI	9fe8ca7294	update changelog	2023-01-27 10:04:18 +00:00
Sebastian Gumprich donestefan schurzi	89138be4ec	Rewrite system account detection and hardening and create tests (#621 ) * rewrite system account detection and hardening * resolve failures created when resolving merge conflicts Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for shell removal tasks Signed-off-by: Sebastian Gumprich <[email protected]> * Update molecule/os_hardening/prepare.yml Signed-off-by: Martin Schurz <[email protected]> * split tasks for locking and setting shell Signed-off-by: Martin Schurz <[email protected]> * fix some more linting Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Martin Schurz <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: schurzi <[email protected]>	2023-01-27 11:01:03 +01:00
dev-sec CI	f1169749f4	update changelog	2023-01-25 22:59:48 +00:00
schurzi	ee80418496	Merge pull request #618 from dev-sec/deprecate_intitramfs deprecate rebuilding of initramfs	2023-01-25 23:56:36 +01:00
Martin Schurz	7f8e9919ee	add readme Signed-off-by: Martin Schurz <[email protected]>	2023-01-25 22:30:17 +01:00
dev-sec CI	bbee0b74ec	update changelog	2023-01-25 12:21:00 +00:00
schurzi	0e8533049d	Merge pull request #620 from dev-sec/molecule_fixes Fixed problems with running molecule locally with cgroup v2	2023-01-25 13:18:50 +01:00
Sebastian Gumprich	a1028c7504	deprecate initramfs Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-25 13:07:37 +01:00
dev-sec CI	aa555b9290	update changelog	2023-01-25 08:15:45 +00:00
mmitnyan	83a0a9242b	Support for Amazon Linux 2 (#624 ) Signed-off-by: Manuel Mitnyan <[email protected]> Signed-off-by: Manuel Mitnyan <[email protected]>	2023-01-25 09:12:25 +01:00
dev-sec CI	fdd0bfc72a	update changelog	2023-01-24 13:27:02 +00:00
schurzi	154f862ccd	Merge pull request #622 from dev-sec/stop_old_tests cancel running tests if new commit to branch is made	2023-01-24 13:21:18 +01:00
Sebastian Gumprich	db4bd32767	cancel running tests if new commit to branch is made Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-24 13:08:04 +01:00
Sebastian Gumprich	281d706660	add waiver to not test mounts Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-24 13:03:04 +01:00
dev-sec CI	85271c2375	update changelog	2023-01-24 12:01:58 +00:00
Sebastian Gumprich	d386bf36d2	Revert "manage tmp dir in tests" This reverts commit `966f2fe137`.	2023-01-24 12:53:39 +01:00
Sebastian Gumprich	bb588bd777	linting (#603 ) * linting Signed-off-by: Sebastian Gumprich <[email protected]> * more linting Signed-off-by: Sebastian Gumprich <[email protected]> * change line length issues Signed-off-by: Sebastian Gumprich <[email protected]> * replace yes with true in tasks Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * add exception for task Signed-off-by: Sebastian Gumprich <[email protected]> * remove trailing whitespace * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back tasks Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-24 12:40:27 +01:00
Sebastian Gumprich	966f2fe137	manage tmp dir in tests Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-24 12:36:09 +01:00
Sebastian Gumprich	fa2e90c6f2	mount cgroup rw, as suse seems to need it Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-23 15:59:06 +01:00
Sebastian Gumprich	ed1cb1c2a7	add cgroupns: host mode to molecule Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-23 15:59:06 +01:00
Sebastian Gumprich	a0d11faa8a	Fixed problems with running molecule locally with cgroup v2 Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-23 15:59:06 +01:00
dev-sec CI	a94168c84f	update changelog	2023-01-23 09:52:21 +00:00
DonEstefan schurzi DonEstefan Sebastian Gumprich Sebastian Gumprich	674be6dc6f	apply password age settings to exisiting regular users (#582 ) * apply password age settings to regular users * add tests for password ageing Signed-off-by: Sebastian Gumprich <[email protected]> * add debugging vars Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for password ageing Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for password ageing Signed-off-by: Sebastian Gumprich <[email protected]> * Apply suggestions from code review Co-authored-by: schurzi <[email protected]> * add additional condtion for regular users Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: DonEstefan <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: schurzi <[email protected]>	2023-01-23 10:50:05 +01:00
dev-sec CI	c1080de135	update changelog	2023-01-23 08:37:51 +00:00
stdtom	9d2c68ef2f	Preserve default ownership and dir mode for /var/log on Ubuntu (#615 ) * Preserve default ownership and dir mode for /var/log on Ubuntu Signed-off-by: stdtom <[email protected]> * linting Signed-off-by: stdtom <[email protected]> * Define vars for each OS instead of using defaults. Signed-off-by: stdtom <[email protected]> * Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group Signed-off-by: stdtom <[email protected]> Signed-off-by: stdtom <[email protected]>	2023-01-23 09:34:41 +01:00
dev-sec CI	c0b9c87dc1	update changelog	2023-01-19 12:47:40 +00:00
Sebastian Gumprich	142782bad6	add diff to molecule Signed-off-by: Sebastian Gumprich <[email protected]>	2023-01-19 13:46:16 +01:00
rndmh3ro	b3fbfcedbe	Prettified Code!	2023-01-19 12:45:51 +00:00
Paweł Krawczyk Paweł Krawczyk Sebastian Gumprich	88ef3cf3af	Parametrize more auditd.conf options (#535 ) * Parametrize more auditd.conf options * Parametrize more auditd.conf options * Add `os_auditd` options * Add os_auditd_log_group * Add os_auditd_log_group Co-authored-by: Paweł Krawczyk <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2023-01-19 13:45:24 +01:00
dev-sec CI	ca25f50ba6	update changelog	2023-01-12 11:56:07 +00:00
richardlock	a82942a63a	Add support for /etc/auditd.conf num_logs to go with max_log_file_action. (#617 ) Signed-off-by: Richard Lock <[email protected]> Signed-off-by: Richard Lock <[email protected]>	2023-01-12 12:52:48 +01:00
dev-sec CI	fc060376ac	update changelog	2022-12-24 09:43:18 +00:00
dependabot[bot]	16f78bc6be	Bump actions/setup-python from 1 to 4 (#611 ) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 1 to 4. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v1...v4) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-12-24 10:28:54 +01:00
dev-sec CI	764472ae33	update galaxy.yml with new version	2022-12-19 08:43:22 +00:00
dependabot[bot]	395091c41d	Bump creyD/prettier_action from 3.1 to 4.2 (#610 ) Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 3.1 to 4.2. - [Release notes](https://github.com/creyD/prettier_action/releases) - [Commits](https://github.com/creyD/prettier_action/compare/v3.1...v4.2) --- updated-dependencies: - dependency-name: creyD/prettier_action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-12-17 19:53:05 +01:00
dev-sec CI	0a589e5f51	update changelog	2022-12-17 18:49:42 +00:00
John Losito	9d0cc42039	Check for github action updates daily (#609 ) Signed-off-by: John Losito <[email protected]> Signed-off-by: John Losito <[email protected]>	2022-12-17 19:48:02 +01:00
dev-sec CI	5a7783defe	update changelog	2022-12-07 07:55:29 +00:00
Sebastian Gumprichandschurzi	be0642bcfb	add verify-task to check if mysql is running and enabled (#608 ) * add verify-task to check if mysql is running and enabled Signed-off-by: Sebastian Gumprich <[email protected]> * Update molecule/mysql_hardening/verify_tasks/service.yml Co-authored-by: schurzi <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: schurzi <[email protected]>	2022-12-07 08:49:07 +01:00
dev-sec CI	b0454fade2	update changelog	2022-11-30 15:15:52 +00:00
DonEstefananddonestefan	bb3c63e321	fix IPv6 hardening (#607 ) Signed-off-by: DonEstefan <[email protected]> Signed-off-by: DonEstefan <[email protected]> Co-authored-by: donestefan <[email protected]>	2022-11-30 16:13:25 +01:00
dev-sec CI	d3e6df3dbf	update changelog	2022-11-29 14:11:39 +00:00
Sebastian GumprichandFlorian Goth	e66c2eb6bb	Add OpenSUSE support (#605 ) * Add variables for mariadb on opensuse Signed-off-by: Florian Goth <[email protected]> * enable pipeline Signed-off-by: Florian Goth <[email protected]> * add a note about the reuirement of the jmespath library. Signed-off-by: Florian Goth <[email protected]> * Use python3 on opensuse Signed-off-by: Florian Goth <[email protected]> * fix my yml. Signed-off-by: Florian Goth <[email protected]> * use right ansible variable Signed-off-by: Florian Goth <[email protected]> * Suse requires python-rpm Signed-off-by: Florian Goth <[email protected]> * try zypper Signed-off-by: Florian Goth <[email protected]> * python-xml Signed-off-by: Florian Goth <[email protected]> * another try at fixing the install Signed-off-by: Florian Goth <[email protected]> * fix my yml Signed-off-by: Florian Goth <[email protected]> * another try Signed-off-by: Florian Goth <[email protected]> * another try Signed-off-by: Florian Goth <[email protected]> * another try now with rpm. Signed-off-by: Florian Goth <[email protected]> * fix my yml... Signed-off-by: Florian Goth <[email protected]> * typo Signed-off-by: Florian Goth <[email protected]> * do the test for Suse on the shell and not in ansible Signed-off-by: Florian Goth <[email protected]> * specify to use bash Signed-off-by: Florian Goth <[email protected]> * specify to use bash * try the removes keyword of builtin.shell Signed-off-by: Florian Goth <[email protected]> * fix ansible syntax Signed-off-by: Florian Goth <[email protected]> * fix zypper syntax Signed-off-by: Florian Goth <[email protected]> * ensure pymysql is present Signed-off-by: Florian Goth <[email protected]> * set ansible python interpreter in converge-step, too Signed-off-by: Sebastian Gumprich <[email protected]> * move install task to prepare Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Florian Goth <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Florian Goth <[email protected]>	2022-11-29 15:09:27 +01:00
dev-sec CI	61e92aaaf6	update changelog	2022-11-24 07:41:20 +00:00
Jacob Sievert	ade6deeba2	Updates handlers for new ansible syntax and deprecated options for legacy commands (#602 ) * Update main.yml fixes the handler file and set new syntax Signed-off-by: Jacob Sievert <[email protected]> * changes command module from legacy to builtin. Signed-off-by: Jacob Sievert <[email protected]> Signed-off-by: Jacob Sievert <[email protected]>	2022-11-24 08:39:05 +01:00
dev-sec CI	66f5c6b131	update changelog	2022-11-23 12:51:31 +00:00
Cristian Baldi	7d1da63c94	Allow ssh_allow_tcp_forwarding to be a boolean (#600 ) * Allow ssh_allow_tcp_forwarding to be a boolean Signed-off-by: Cristian Baldi <[email protected]> * Update documentation related to ssh_allow_tcp_forwarding Signed-off-by: Cristian Baldi <[email protected]> Signed-off-by: Cristian Baldi <[email protected]>	2022-11-23 13:45:01 +01:00
dev-sec CI	03f3974f37	update changelog	2022-11-17 13:01:02 +00:00
schurzi	006e3bf75b	Merge pull request #601 from dev-sec/contribute_dco add notice to sign-off work to contributor guideline	2022-11-17 13:58:08 +01:00
Martin Schurz	98c645db5f	add notice to sign-off work to contributor guideline Signed-off-by: Martin Schurz <[email protected]>	2022-11-17 13:47:11 +01:00
dev-sec CI	dd97a90b65	update changelog	2022-11-08 09:29:35 +00:00
schurzi	d982a89cc1	Merge pull request #598 from dennisse/master OpenBSD does not support GSSAPI Authentication	2022-11-08 10:26:42 +01:00
Dennis Eriksen	681898bd96	OpenBSD does not support GSSAPIAuthentication ... and freaks out when it is mentioned in the config files. So let's just remove the GSSAPI-stuff. Signed-off-by: Dennis Eriksen <[email protected]>	2022-11-08 09:12:18 +01:00
dev-sec CI	e32d550e9b	update changelog	2022-11-04 11:03:08 +00:00
Dennis Eriksen	4df95e3733	OpenBSD does not set distributiuon_major_version (#597 ) This role fails with `The task includes an option with an undefined variable` on OpenBSD because `distributiuon_major_version` is not set on OpenBSD. We should either default to "" if the variable is not set, or remove `vars/OpenBSD.yml`. I would prefer the former :) Signed-off-by: Dennis Eriksen <[email protected]> Signed-off-by: Dennis Eriksen <[email protected]>	2022-11-04 12:00:55 +01:00
dev-sec CI	05205eb413	update changelog	2022-11-01 17:13:21 +00:00
schurzi	d0407b17c4	Merge pull request #596 from dev-sec/templates add Ansible specific templates for issues	2022-11-01 18:10:59 +01:00
Martin Schurz	1346e37e14	actually add templates ... Signed-off-by: Martin Schurz <[email protected]>	2022-10-28 10:26:00 +02:00
dev-sec CI	c2ee3105c7	update changelog	2022-10-28 05:16:41 +00:00
schurzi	613fbd82da	use github templates for new issues (#595 ) Signed-off-by: Martin Schurz <[email protected]> Signed-off-by: Martin Schurz <[email protected]>	2022-10-28 07:14:58 +02:00
dev-sec CI	9530615d5f	update galaxy.yml with new version	2022-10-27 18:48:57 +00:00
dev-sec CI	24d0153815	update changelog	2022-10-27 18:46:03 +00:00
schurzi	99fe8b6969	Merge pull request #594 from dlouzan/fix/type-cast-variables fix(os_hardening): cast expected int types in pam tasks	2022-10-27 20:43:17 +02:00
Martin Schurz	f496b385dd	use github templates for new issues Signed-off-by: Martin Schurz <[email protected]>	2022-10-27 20:41:06 +02:00
Diego Louzán	f8295d5248	fix(os_hardening): cast expected int types in pam tasks Signed-off-by: Diego Louzán <[email protected]>	2022-10-27 16:50:08 +02:00
dev-sec CI	a1f75f877b	update changelog	2022-10-26 08:33:13 +00:00
schurzi	901923bac2	Merge pull request #588 from dev-sec/support_more_os Support more os	2022-10-26 10:13:40 +02:00
Martin Schurz	c30ef42355	exclude el9 from vm tests Signed-off-by: Martin Schurz <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	e2b963d711	change baselines back to master Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	414efd6125	use correct centos stream images, try to fix prepare step for debian tests Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	87a461fc57	use forked mysql-baseline Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	dac66f4a88	simplify OS-vars files Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	3b8b394f10	add ssh-vars for new OS Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	b27ffd08b0	add mysql-vars for new OS Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:58:53 +02:00
dev-sec CI	8ee946a537	update changelog	2022-10-24 08:04:42 +00:00
Sebastian Gumprich	a176443f22	add support for centos stream 8 and 9, rocky 9 Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-24 10:03:07 +02:00
Sebastian Gumprich	9d75e3b00e	test crypto changes from ssh-baseline Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-24 10:03:07 +02:00
schurzi	a1b80fe657	adopt all current suggestions from ansible-lint (#592 )	2022-10-24 09:42:23 +02:00
dev-sec CI	53be805099	update changelog	2022-10-21 09:07:46 +00:00
donestefan	464d8df8e8	add hardening of root user account(s) (#579 )	2022-10-21 11:05:43 +02:00
`@@ -1,2 +1,2 @@`
	`---`	`---`
	`requires_ansible: '>=2.9.10'`	`requires_ansible: ">=2.9.10"`