add debian 12 support (#684 )

* add debian 12 support Signed-off-by: Sebastian Gumprich <[email protected]> * temp disable pam-checks Signed-off-by: Sebastian Gumprich <[email protected]> * remove debian12 from vagrant tests as there's no box yet Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * install pam-tester with python3 and use full path to it Signed-off-by: Sebastian Gumprich <[email protected]> * install python3-setupttools in verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * fix path for pam-tester in all tests Signed-off-by: Sebastian Gumprich <[email protected]> * set python interpreter to 3 for verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * Revert "set python interpreter to 3 for verify-tests" This reverts commit 00b6556e33. * add back accidentally deleted tasks Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>
update changelog
2023-08-04 12:59:40 +02:00 · 2023-07-24 09:37:51 +00:00 · 2023-07-24 11:34:47 +02:00 · 2023-06-20 13:22:05 +00:00 · 2023-06-20 15:18:55 +02:00 · 2023-06-12 12:22:09 +00:00
154 changed files with 3024 additions and 1672 deletions
@@ -4,14 +4,14 @@
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
-  - .cache/  # implicit unless exclude_paths is defined in config
+  - .cache/ # implicit unless exclude_paths is defined in config
  - .yamllint
  - ../molecule/
  - ../.github/
 skip_list:
  - fqcn-builtins
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
 skip_list:
  - var-naming[no-role-prefix]
@@ -1,49 +0,0 @@
 ---
 name: Bug report
 about: Create a report to help us improve
 ---
 **Describe the bug**
 A clear and concise description of what the bug is.
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 **Actual behavior**
 <!--- Paste verbatim command output between quotes -->
 ```paste below
 ```
 **Example Playbook**
 <!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
 ```paste below
 ```
 **OS / Environment**
 <!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
 **Ansible Version**
 <!--- Paste verbatim output from "ansible --version" between quotes -->
 ```paste below
 ```
 **Role Version**
 <!--- Paste version of the role between quotes -->
 ```paste below
 ```
 **Additional context**
 Add any other context about the problem here.
@@ -0,0 +1,97 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Bug report"
 description: "Create a report to help us improve."
 labels: [
  "bug"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Reporting Bugs ld follow some simple rules:
        - **Check**, if you can find similar bugs
        - **Describe** what is happening and what should happen
        - **Explain** how to reproduce the problem
        - **Add** more details and attachments
        - **Follow up**, if somebody is having questions or needs more details
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Describe the bug
      placeholder: A clear and concise description of what the bug is.
    validations:
      required: true
  - type: textarea
    id: reprod
    attributes:
      label: "Reproduction steps"
      render: Shell
      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: currentbehavior
    attributes:
      label: "Current Behavior"
      description: Please describe the results you received
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: expectedbehavior
    attributes:
      label: "Expected Behavior"
      description: Please describe the results you expect
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: os
    attributes:
      label: "OS / Environment"
      value: |
        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
    validations:
      required: true
  - type: textarea
    id: ansible
    attributes:
      label: "Ansible Version"
      render: Shell
      value: |
        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: collection
    attributes:
      label: "Collection Version"
      render: Shell
      value: |
        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
      value: |
        ...
    validations:
      required: false
@@ -1,16 +0,0 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
 ---
 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Additional context**
 Add any other context or screenshots about the feature request here.
@@ -0,0 +1,55 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Feature request"
 description: "Suggest an idea for this project."
 labels: [
  "enhancement"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Requesting a new feature or enhancement is following some simple rules:
        - **Check**, if the feature is already requested
        - **Describe** what your feature will bring to the community
        - **Explain** the criteria to fulfill the request
        - **Add** more details like mock ups, attachments, lists, screenshots
        - **Follow Up** in the discussion to the feature
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Is your feature request related to a problem? Please describe.
      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
    validations:
      required: true
  - type: textarea
    id: solution
    attributes:
      label: "Solution"
      description: Describe the solution you'd like
      placeholder: A clear and concise description of what you want to happen.
    validations:
      required: false
  - type: textarea
    id: alternatives
    attributes:
      label: "Alternatives"
      description: Describe alternatives you've considered
      placeholder: A clear and concise description of any alternative solutions or features you've considered.
    validations:
      required: false
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Add any other context or screenshots about the feature request here.
      value: |
        ...
    validations:
      required: false
@@ -1,12 +0,0 @@
 ---
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
  - package-ecosystem: "pip"  # See documentation for possible values
    directory: "/"  # Location of package manifests
    schedule:
      interval: "daily"
@@ -5,9 +5,13 @@ on:  # yamllint disable-line rule:truthy
  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
  push:
    branches: [master]
    paths:
      - 'roles/**'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths:
      - 'roles/**'
 jobs:
  ansible-lint:
@@ -0,0 +1,14 @@
 ---
 name: Codespell - Spellcheck
 on:  # yamllint disable-line rule:truthy
  push:
    branches: [master]
  pull_request:
    branches: [master]
 jobs:
  codespell:
    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
    with:
      ignore_words_list: "chage"
@@ -15,9 +15,19 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
  schedule:
    - cron: '0 6 * * 0'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -35,9 +45,10 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
          - debian12
          # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # needs to be fixed
+          # - arch  # geerlingguy.mysql does not support arch
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
@@ -46,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11
      - name: Install dependencies
        run: |
@@ -58,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      # that was a hard one to fix. robert did it thankfully
      # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
      - name: disable apparmor on debian systems
@@ -14,9 +14,19 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
  schedule:
    - cron: '0 6 * * 1'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -34,7 +44,8 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
@@ -45,10 +56,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11
      - name: Install dependencies
        run: |
@@ -57,11 +68,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          molecule --version
@@ -14,9 +14,19 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
  schedule:
    - cron: '0 6 * * 3'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -29,14 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
          - fedora37
          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
          - amazon2023
          - opensuse_tumbleweed
-          # - arch  # needs to be fixed
+          - arch
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -44,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11
      - name: Install dependencies
        run: |
@@ -56,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -14,6 +14,16 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
  schedule:
    - cron: '0 6 * * 2'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
@@ -25,17 +35,20 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centosstream8
+          - centos8s
-          - centosstream9
+          - centos9s
          - rocky8
          - rocky9
          - fedora37
          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          # - opensuse42  # opensuse currently cannot get an ip address
+          # - debian12  # waiting for https://github.com/lavabit/robox/pull/274
-          # - arch  - arch is currently not supported by cinc-auditor
+          - opensuse15
          # - arch  # needs fix for audit
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -43,11 +56,6 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          molecule --version
@@ -21,6 +21,6 @@ jobs:
          ref: ${{ github.head_ref }}
      - name: Prettify code
-        uses: creyD/prettier_action@v3.1
+        uses: creyD/prettier_action@v4.3
        with:
          prettier_options: --write {**/*,*}.md
@@ -63,7 +63,7 @@ jobs:
          path: ./CHANGELOGRELEASE.md
      - name: Delete old drafts
-        uses: hugo19941994/[email protected].0
+        uses: hugo19941994/[email protected].1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,9 +14,19 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
  schedule:
    - cron: '0 6 * * 5'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -29,15 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora
+          - fedora37
          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
-          # - arch  # needs to be fixed
+          - amazon2023
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -45,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11
      - name: Install dependencies
        run: |
@@ -57,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -0,0 +1,52 @@
 ---
 name: "devsec.ssh_hardening BSD"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
  schedule:
    - cron: '0 6 * * 5'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - openbsd7
          - freebsd12
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Test with molecule
        run: |
          molecule --version
          molecule test -s ssh_hardening_bsd
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -14,9 +14,19 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
  schedule:
    - cron: '0 6 * * 4'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -29,15 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora
+          - fedora37
          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
-          # - arch  # needs to be fixed
+          - amazon2023
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -45,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11
      - name: Install dependencies
        run: |
@@ -57,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -1,26 +0,0 @@
 ---
 # Based on ansible-lint config
 extends: default
 rules:
  braces:
    max-spaces-inside: 1
    level: error
  brackets:
    max-spaces-inside: 1
    level: error
  colons:
    max-spaces-after: -1
    level: error
  commas:
    max-spaces-after: -1
    level: error
  empty-lines:
    max: 3
    level: error
  hyphens:
    level: error
  key-duplicates: enable
  line-length: disable
  new-lines:
    type: unix
@@ -1,11 +1,168 @@
 # Changelog
-## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
+## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-07-24)
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
 **Implemented enhancements:**
 - Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
 - auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
 - feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
 - Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
 **Fixed bugs:**
 - Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
 - FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
 **Closed issues:**
 - What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
 -  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
 - TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
 - After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
 - Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
 **Merged pull requests:**
 - setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
 - expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
 - use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
 - add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 ## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)
 **Implemented enhancements:**
 - Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
 - add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
 - Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
 **Fixed bugs:**
 - getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
 - Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
 - devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
 - fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
 **Closed issues:**
 - Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
 - Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
 - Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
 - Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
 **Merged pull requests:**
 - Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
 - Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
 - simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
 - Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 ## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.6.0)
 **Implemented enhancements:**
 - make number of warning days before user password expires configurable [\#628](https://github.com/dev-sec/ansible-collection-hardening/pull/628) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
 **Merged pull requests:**
 - Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 [\#627](https://github.com/dev-sec/ansible-collection-hardening/pull/627) ([dependabot[bot]](https://github.com/apps/dependabot))
 ## [8.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.0) (2023-01-30)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...8.5.0)
 **Implemented enhancements:**
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
 - password ageing not enforced [\#570](https://github.com/dev-sec/ansible-collection-hardening/issues/570)
 - Rewrite system account detection and hardening and create tests [\#621](https://github.com/dev-sec/ansible-collection-hardening/pull/621) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
 **Fixed bugs:**
 - os\_hardening is setting wrong ownership for /var/log on Ubuntu [\#614](https://github.com/dev-sec/ansible-collection-hardening/issues/614)
 - \[os\_hardening\] Task for setting `initramfs` modules does not match its condition [\#590](https://github.com/dev-sec/ansible-collection-hardening/issues/590) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Support for Amazon Linux 2 [\#624](https://github.com/dev-sec/ansible-collection-hardening/pull/624) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mmitnyan](https://github.com/mmitnyan))
 **Deprecated:**
 - deprecate rebuilding of initramfs [\#618](https://github.com/dev-sec/ansible-collection-hardening/pull/618) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 **Closed issues:**
 - Ubuntu 22.04 vars file missing? [\#619](https://github.com/dev-sec/ansible-collection-hardening/issues/619)
 - SSH KexAlgorithms causes SSH daemon to fail [\#500](https://github.com/dev-sec/ansible-collection-hardening/issues/500)
 - Playbook won't run for hardening  [\#462](https://github.com/dev-sec/ansible-collection-hardening/issues/462)
 **Merged pull requests:**
 - do not let dependabot label our prs [\#626](https://github.com/dev-sec/ansible-collection-hardening/pull/626) ([rndmh3ro](https://github.com/rndmh3ro))
 - run linting only when files inside roles change [\#625](https://github.com/dev-sec/ansible-collection-hardening/pull/625) ([rndmh3ro](https://github.com/rndmh3ro))
 - cancel running tests if new commit to branch is made [\#622](https://github.com/dev-sec/ansible-collection-hardening/pull/622) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Fixed problems with running molecule locally with cgroup v2 [\#620](https://github.com/dev-sec/ansible-collection-hardening/pull/620) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
 - linting [\#603](https://github.com/dev-sec/ansible-collection-hardening/pull/603) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
 **Implemented enhancements:**
 - Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
 - Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Add OpenSUSE support  [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
 - OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 - add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
 - use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
 **Fixed bugs:**
 - os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
 - ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
 - OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 **Merged pull requests:**
 - Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
 - add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
 - add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
 ## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
 **Implemented enhancements:**
 - add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 **Fixed bugs:**
 - cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
 - do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
 **Closed issues:**
@@ -16,6 +173,8 @@
 **Merged pull requests:**
 - adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
@@ -43,7 +202,7 @@
 **Merged pull requests:**
 - update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
@@ -72,7 +231,7 @@
 **Implemented enhancements:**
 - revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
@@ -143,7 +302,7 @@
 **Closed issues:**
- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+- No such file directory error triggered by the  kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
 **Merged pull requests:**
@@ -582,7 +741,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -633,7 +792,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 - update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
 - add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -659,7 +818,7 @@
 - \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
 - `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
 - login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
 - Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
 - minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
 - wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
@@ -747,7 +906,7 @@
 - adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
 - move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
 - Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
@@ -799,7 +958,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 ## Expectations
 ## Sign off Your Work
 The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
 [Here is the full text of the DCO](http://developercertificate.org/).
 Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
 ```text
 This is my commit message
 Signed-off-by: Random J Developer <[email protected]>
 ```
 Git even has a -s command line option to append this automatically to your commit message:
 ```text
 git commit -s -m 'This is my commit message'
 ```
 ### Don't reinvent the wheel
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
@@ -26,7 +26,7 @@
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@
 **Fixed bugs:**
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -11,13 +11,13 @@
 This collection provides battle tested hardening for:
 - Linux operating systems:
-  - CentOS 7
+  - CentOS 7/8/9
-  - Rocky Linux 8
+  - Rocky Linux 8/9
-  - Debian 10/11
+  - Debian 10/11/12
  - Ubuntu 18.04/20.04/22.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
-  - Fedora (some roles supported)
+  - Fedora 37/38 (some roles supported)
  - Suse Tumbleweed (some roles supported)
 - MySQL
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.2.0
+version: 8.7.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -42,3 +42,4 @@ build_ignore:
  - .tox
  - tox.ini
  - .yamllint
  - renovate.json
@@ -1,2 +1,2 @@
 ---
-requires_ansible: '>=2.9.10'
+requires_ansible: ">=2.9.10"
@@ -24,6 +24,13 @@
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - include_role:
        name: mysql_hardening
  vars:
@@ -11,24 +11,18 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
    cgroupns_mode: host
    pre_build_image: true
    environment:
      container: docker
    security_opts:
      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -58,7 +52,8 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
-    # - idempotence  # not idempotent
+    - idempotence
    - verify
    - destroy
@@ -15,6 +15,12 @@
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int >= 11
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - name: Use Python 2 on Debian 10
      set_fact:
        ansible_python_interpreter: /usr/bin/python
@@ -29,11 +35,9 @@
        update_cache: true
      when: ansible_os_family == 'Debian'
-    - name: install required tools on SuSE
+    - name: Install required python packages on Suse
-      community.general.zypper:
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-        name: "python-xml"
+      when: ansible_os_family == 'Suse'
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: create missing directory
      file:
@@ -56,15 +60,18 @@
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
-
+    - name: Install required MySQL Python libraries on RHEL
      yum:
        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
      when:
        - ansible_os_family == "RedHat"
        - ansible_distribution_major_version == "7"
    - include_role:
        name: dev-sec.mysql
-    - name: create a user with an empty password
+    - name: include MySQL user prepare tasks
-      community.mysql.mysql_query:
+      include_tasks: prepare_tasks/mysql_users.yml
        query:
          - "CREATE USER foo@bar;"
        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
@@ -0,0 +1,15 @@
 ---
 - name: create users for test
  community.mysql.mysql_query:
    query:
      - "CREATE USER 'user'@'delete';"
      - "CREATE USER 'user'@'127.0.0.1';"
      - "CREATE USER 'user'@'::1';"
      - "CREATE USER 'user'@'%';"
      - "CREATE USER 'user'@'192.168.0.%';"
      - "CREATE USER 'user'@'192.168.0.1';"
      - "CREATE USER    '%'@'192.168.0.1';"
      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -1,7 +1,5 @@
 ---
 roles:
  - name: geerlingguy.git
    version: 3.0.0
  - name: dev-sec.mysql
    version: master
@@ -6,26 +6,12 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Use Python 3 on Suse
-      copy:
+      set_fact:
-        content: |
+        ansible_python_interpreter: /usr/bin/python3
-          openSUSE Faked Enterprise 2020 (x86_64)
+      when:
-          VERSION = 2020
+        - ansible_os_family == 'Suse'
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: install procps for debian systems
      apt:
@@ -34,17 +20,27 @@
        update_cache: true
      when: ansible_distribution == 'Debian'
-    - name: download cinc-auditor
+    - name: include tests for the service
-      get_url:
+      include_tasks: verify_tasks/service.yml
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
-    - name: install cinc-auditor
+    - name: include tests for MySQL user
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+      include_tasks: verify_tasks/mysql_users.yml
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
+      command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,25 @@
 ---
 - name: Get all users from MySQL server
  community.mysql.mysql_query:
    query: >
      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users
 - name: create list of users from mysql query
  set_fact:
    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
 - name: assert that only accounts with password remain
  ansible.builtin.assert:
    that:
      - '"user@delete" not in mysql_users_list'
      - '"[email protected]" not in mysql_users_list'
      - '"user@::1" not in mysql_users_list'
      - '"user@%" not in mysql_users_list'
      - '"[email protected].%" not in mysql_users_list'
      - '"[email protected]" not in mysql_users_list'
      - '"%@192.168.0.1" not in mysql_users_list'
      - '"[email protected]" in mysql_users_list'
      - '"user@keep" in mysql_users_list'
      - '"[email protected].%" in mysql_users_list'
@@ -0,0 +1,16 @@
 ---
 - name: Load variables from role to use the "mysql_daemon" variable
  ansible.builtin.include_role:
    name: devsec.hardening.mysql_hardening
    apply:
      tags:
        - never
 - name: Populate service facts
  ansible.builtin.service_facts:
 - name: Check if MySQL is running and enabled
  assert:
    that:
      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
@@ -2,6 +2,8 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -10,25 +10,18 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -58,6 +51,7 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,4 +1,3 @@
 ---
 roles:
  - geerlingguy.git
  - geerlingguy.nginx
@@ -6,48 +6,29 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: install procps for debian systems
      copy:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: Run the equivalent of "apt-get update" as a separate step
      apt:
        update_cache: true
      when: ansible_facts.os_family == 'Debian'
    - name: install required tools on debian
      apt:
        name: procps
-      when: ansible_facts.os_family == 'Debian'
+        state: present
-
+        update_cache: true
-    - name: download cinc-auditor
+      when: ansible_distribution == 'Debian'
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
+      command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -17,6 +17,7 @@
  vars:
    os_security_users_allow: change_user
    os_security_kernel_enable_core_dump: false
    os_auditd_num_logs: 10
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
@@ -27,7 +28,11 @@
    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
    os_filesystem_whitelist: []
    os_yum_repo_file_whitelist: ['foo.repo']
    os_users_without_password_ageing: ['pw_no_ageing']
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
    os_ignore_users: ["shell_sys_acc"]
    os_ignore_home_folder_users: ["user_with_777_home"]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -1,8 +1,4 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: docker
 platforms:
@@ -10,25 +6,18 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -58,6 +47,7 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -2,8 +2,6 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -59,6 +57,11 @@
      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
-    - name: include YUM prepare tasks
+    - name: include preparation tasks
-      include_tasks: prepare_tasks/netrc.yml
+      ansible.builtin.include_tasks:
-
+        file: "{{ item }}"
      loop:
        - prepare_tasks/netrc.yml
        - prepare_tasks/pw_ageing.yml
        - prepare_tasks/sys_account_shell.yml
        - prepare_tasks/ignore_home_folders.yml
@@ -0,0 +1,9 @@
 ---
 - name: Create user whose home-folder should not be touched
  ansible.builtin.user:
    name: "user_with_777_home"
 - name: Change mode of home-folder for user to 777
  ansible.builtin.file:
    path: /home/user_with_777_home
    mode: "0777"
@@ -0,0 +1,9 @@
 - name: Create user those password ageing should not be changed
  user:
    name: "pw_no_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
 - name: Create user those password ageing should be changed
  user:
    name: "pw_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
@@ -0,0 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
  user:
    name: "shell_sys_acc"
    shell: "/bin/bash"
@@ -1,3 +0,0 @@
 ---
 roles:
  - geerlingguy.git
@@ -6,39 +6,19 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: set ansible_python_interpreter to "/usr/bin/python3"
-      copy:
+      set_fact:
-        content: |
+        ansible_python_interpreter: "/usr/bin/python3"
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: include verification tasks
-      zypper:
+      ansible.builtin.include_tasks:
-        name: git
+        file: "{{ item }}"
-        state: present
+      loop: 
-      when: ansible_facts.os_family == 'Suse'
+        - verify_tasks/sys_account_shell.yml
-
+        - verify_tasks/pw_ageing.yml
-    - name: Run the equivalent of "apt-get update" as a separate step
+        - verify_tasks/netrc.yml
-      apt:
+        - verify_tasks/ignore_home_folders.yml
        update_cache: true
      when: ansible_facts.os_family == 'Debian'
    - name: install required tools on debian
      apt:
        name: procps
      when: ansible_facts.os_family == 'Debian'
    - name: include netrc tests
      include_tasks: verify_tasks/netrc.yml
    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
@@ -48,17 +28,23 @@
      include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
-    - name: download cinc-auditor
+- name: Verify
-      get_url:
+  hosts: localhost
-        url: https://omnitruck.cinc.sh/install.sh
+  environment:
-        dest: /tmp/install.sh
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-        mode: '0775'
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-    - name: install cinc-auditor
+  tasks:
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: Execute cinc-auditor tests
-
+      command: >
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
+        docker run
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+        --volume /run/docker.sock:/run/docker.sock
        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --waiver-file /waivers.yaml
        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -72,6 +58,16 @@
        msg: "Inspec failed to validate"
      when: test_results.rc != 0
 - name: Verify
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
    # test if variable can be overridden
    - name: workaround for https://github.com/ansible/ansible/issues/66304
      set_fact:
@@ -0,0 +1,10 @@
 ---
 - name: Get properties of user user_with_777_home's home-folder
  ansible.builtin.stat:
    path: /home/user_with_777_home
  register: stats
 - name: Check that the home-folder has mode 777
  ansible.builtin.assert:
    that:
      - stats.stat.mode == "0777"
@@ -1,9 +1,17 @@
 ---
- name: download pam-tester
+
-  get_url:
+- name: install pip
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+  package:
-    dest: /bin/pam-tester
+    name:
-    mode: 0555
+      - python3-pip
      - python3-setuptools
    state: present
 - name: install pam-tester
  ansible.builtin.pip:
    name: pam-tester
    state: present
    executable: /usr/bin/pip3
 - name: set password for test
  set_fact:
@@ -21,26 +29,26 @@
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"
- name: check successfull login with correct password
+- name: check successful login with correct password
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6
- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +58,9 @@
  pause:
    seconds: 20
- name: check successfull login
+- name: check successful login
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -0,0 +1,32 @@
 ---
 - name: Get Password Expiry date for use pw_no_ageing
  ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_no_ageing is "never"
  ansible.builtin.assert:
    that:
      - "expiry_date.stdout | trim == 'never'"
 - name: Get Password Expiry date for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_ageing is 60 days
  ansible.builtin.assert:
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_warndays
 - name: Check that number of days of warning before password expires is 7 days
  ansible.builtin.assert:
    that:
      - "expiry_warndays.stdout | trim == '7'"
@@ -0,0 +1,8 @@
 - name: Read local linux user database
  getent:
    database: passwd
 - name: Check that shell_sys_acc's shell is still bash
  assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -0,0 +1,9 @@
 os-14:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-15:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-16:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
@@ -8,18 +8,23 @@ driver:
  provider:
    name: libvirt
 platforms:
-  - name: instance
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: "${USER}"
    box: "generic/${MOLECULE_DISTRO}"
    memory: 1024
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
@@ -51,6 +56,7 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -2,8 +2,6 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -16,8 +14,6 @@
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
        name: "*"
        state: latest
        update_cache: true
      when: ansible_os_family == 'Debian'
@@ -6,36 +6,7 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
    - name: install fake SuSE-release for cinc compatibility
      copy:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: Run the equivalent of "apt-get update" as a separate step
      apt:
        update_cache: true
      when: ansible_facts.os_family == 'Debian'
    - name: install required tools on debian
      apt:
        name: procps
      when: ansible_facts.os_family == 'Debian'
    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
@@ -45,17 +16,35 @@
      include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
-    - name: download cinc-auditor
+- name: Verify
-      get_url:
+  hosts: localhost
-        url: https://omnitruck.cinc.sh/install.sh
+  environment:
-        dest: /tmp/install.sh
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-        mode: '0775'
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: get ssh-config
      command:
        cmd: "vagrant ssh-config"
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false
-    - name: install cinc-auditor
+    - name: create ssh-config file
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+      copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
      changed_when: false
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
+    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
        --sudo --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -1,9 +1,15 @@
 ---
- name: download pam-tester
+- name: install pip
-  get_url:
+  package:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    name:
-    dest: /bin/pam-tester
+      - python3-pip
-    mode: 0555
+      - python3-setuptools
    state: present
 - name: install pam-tester
  ansible.builtin.pip:
    name: pam-tester
    state: present
 - name: set password for test
  set_fact:
@@ -21,7 +27,7 @@
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"
- name: check successfull login with correct password
+- name: check successful login with correct password
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
@@ -29,7 +35,7 @@
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
  environment:
@@ -38,7 +44,7 @@
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6
- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
  environment:
@@ -50,7 +56,7 @@
  pause:
    seconds: 20
- name: check successfull login
+- name: check successful login
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
@@ -1,8 +1,4 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
 platforms:
@@ -10,25 +6,18 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -64,6 +53,7 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,3 +0,0 @@
 ---
 roles:
  - geerlingguy.git
@@ -1,48 +1,19 @@
 ---
 - name: Verify
-  hosts: all
+  hosts: localhost
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
    - name: install fake SuSE-release for cinc compatibility
      copy:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: install crypto compat modules on fedora
      dnf:
        name: libxcrypt-compat
      when: ansible_facts.distribution == 'Fedora'
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
+      command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,22 @@
 *******
 Docker driver installation guide
 *******
 Requirements
 ============
 * Docker Engine
 Install
 =======
 Please refer to the `Virtual environment`_ documentation for installation best
 practices. If not using a virtual environment, please consider passing the
 widely recommended `'--user' flag`_ when invoking ``pip``.
 .. _Virtual environment: https://virtualenv.pypa.io/en/latest/
 .. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
 .. code-block:: bash
    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,14 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
    - include_role:
        name: ssh_hardening
  vars:
    sftp_enabled: false
@@ -0,0 +1,58 @@
 ---
 driver:
  name: vagrant
  provider:
    name: libvirt
 platforms:
  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: "${USER}"
    box: "generic/${MOLECULE_DISTRO}"
    memory: 1024
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
    defaults:
      interpreter_python: auto_silent
      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
    ANSIBLE_PIPELINING: "True"
 scenario:
  create_sequence:
    - dependency
    - create
    - prepare
  check_sequence:
    - dependency
    - destroy
    - create
    - prepare
    - converge
    - check
    - destroy
  converge_sequence:
    - dependency
    - create
    - prepare
    - converge
  destroy_sequence:
    - destroy
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - converge
    - idempotence
    - verify
    - destroy
@@ -0,0 +1,32 @@
 ---
 - name: prepare OpenBSD host
  hosts: all
  become: true
  gather_facts: false
  tasks:
    - name: install python
      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
      raw: "pkg_add python%3.10"
      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: created needed directory
      file:
        path: "/var/run/sshd"
        state: directory
    - name: create ssh host keys  # noqa ignore-errors
      command: "ssh-keygen -A"
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
            ansible_facts.distribution == "Fedora" or
            ansible_facts.distribution == "Amazon" or
            ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,55 @@
 ---
 - name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
  hosts: all
  become: true
  tasks:
    - name: use the type command instead of which to detect existing commands
      file:
        src: "/usr/bin/which"
        dest: "/usr/bin/type"
        state: hard
      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: get ssh-config
      command: 
        cmd: "vagrant ssh-config"
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false
    - name: create ssh-config file
      copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
      changed_when: false
    - name: Execute cinc-auditor tests
      command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
        --sudo --no-show-progress --no-color
        --waiver-file /waivers.yaml
        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
      debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
      fail:
        msg: "Inspec failed to validate"
      when: test_results.rc != 0
@@ -0,0 +1,3 @@
 sshd-45:
  run: false
  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -0,0 +1,21 @@
 ssh-17:
  run: false
  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 ssh-18:
  run: false
  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 sshd-30:
  run: false
  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-31:
  run: false
  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-32:
  run: false
  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-33:
  run: false
  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 sshd-34:
  run: false
  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
@@ -1,8 +1,4 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
 platforms:
@@ -10,25 +6,18 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -58,6 +47,7 @@ scenario:
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,3 +0,0 @@
 ---
 roles:
  - geerlingguy.git
@@ -0,0 +1,15 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    ":gitSignOff"
  ],
  "dependencyDashboard": true,
  "dependencyDashboardAutoclose": true,
  "packageRules": [
    {
      "matchUpdateTypes": ["patch", "minor"],
      "automerge": true
    }
  ]
 }
@@ -1,4 +1,5 @@
-molecule[docker]
+molecule
 molecule-plugins[docker]
 yamllint
 ansible
 ansible-lint
@@ -91,7 +91,7 @@
 **Implemented enhancements:**
- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
 - add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
 **Closed issues:**
@@ -16,6 +16,7 @@ It configures:
 - Ansible 2.9.0
 - An existing MySQL installation
 - python-jmespath on the ansible host
 ### Example playbook
@@ -7,9 +7,9 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true
 # general configuration
-mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
+mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
-mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed
 mysql_user_home: "{{ ansible_env.HOME }}"
@@ -48,6 +48,6 @@ mysql_hardening_options:
  automatic-sp-privileges: 0
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
-  secure-file-priv: '/tmp'
+  secure-file-priv: /tmp
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{ mysql_hardening_user }}'
+  user: "{{ mysql_hardening_user }}"
@@ -1,7 +1,6 @@
 ---
 - name: Restart mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
    state: restarted
  when: mysql_hardening_restart_mysql | bool
@@ -1,15 +1,16 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible playbook provides security configuration for mysql.'
+  description: This Ansible playbook provides security configuration for mysql.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
        - "7"
        - "8"
        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -20,7 +21,7 @@ galaxy_info:
        - bullseye
        - buster
    - name: Amazon
-    - name: Fedora
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -1,64 +1,68 @@
 ---
 - name: Protect my.cnf
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_conf_file }}'
+    path: "{{ mysql_hardening_mysql_conf_file }}"
-    mode: '0640'
+    mode: "0640"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
    follow: true
    state: file
 - name: Ensure permissions on mysql-datadir are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_user }}'
+    group: "{{ mysql_hardening_user }}"
-    mode: '0750'
+    mode: "0750"
  when: item is defined and item != ""
  loop:
-    - '{{ mysql_settings.settings.datadir }}'
+    - "{{ mysql_settings.settings.datadir }}"
    - '{{ mysql_datadir | default("") }}'
 - name: Ensure permissions on mysql-logfile are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: file
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0640'
+    mode: "0640"
-  when: item is defined and item != ""
+  when:
    - item is defined
    - item != ""
    - item != "stderr"
    - item != "stdout"
  loop:
-    - '{{ mysql_settings.settings.log_error }}'
+    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
 - name: Check mysql configuration-directory exists and has right permissions
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_confd_dir }}'
+    path: "{{ mysql_hardening_mysql_confd_dir }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0750'
+    mode: "0750"
 - name: Check include-dir directive is present in my.cnf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: '{{ mysql_hardening_mysql_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_conf_file }}"
-    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
+    line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
-    insertafter: 'EOF'
+    insertafter: EOF
    state: present
    backup: true
  notify: Restart mysql
 - name: Apply hardening configuration
-  template:
+  ansible.builtin.template:
-    src: 'hardening.cnf.j2'
+    src: hardening.cnf.j2
-    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
-    mode: '0640'
+    mode: "0640"
  notify: Restart mysql
 - name: Enable mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
-    enabled: '{{ mysql_daemon_enabled }}'
+    enabled: "{{ mysql_daemon_enabled }}"
@@ -1,31 +1,31 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+# we add ^ and $ to denote start and end of string, so this returns only exact matches.
- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
 - name: Check that the variable mysql_distribution is set correctly
  ansible.builtin.assert:
    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
-    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+    fail_msg: mysql_distribution must be set to either mysql or mariadb!
  when: mysql_distribution is defined
 - name: Gather package facts to check for mysql/mariadb version
@@ -34,7 +34,7 @@
  when: not mysql_distribution is defined
 - name: Check if MySQL or MariaDB is used
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
  when: not mysql_distribution is defined
@@ -53,18 +53,20 @@
 # see https://stackoverflow.com/a/59451077/2953919 for the
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
  when:
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"
- include: configure.yml
+- name: Include tasks for configuration
  ansible.builtin.import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
  ansible.builtin.import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
@@ -1,104 +1,94 @@
 ---
 - name: Fail the role if the mysql root password was not set
-  fail:
+  ansible.builtin.fail:
-    msg: 'ERROR - you have to change default mysql_root_password'
+    msg: ERROR - you have to change default mysql_root_password
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
- name: ensure that the root password is present
+- name: Ensure that the root password is present
  community.mysql.mysql_user:
-    name: 'root'
+    name: root
    host_all: true
-    password: '{{ mysql_root_password | mandatory }}'
+    password: "{{ mysql_root_password | mandatory }}"
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 - name: Install .my.cnf with credentials
-  template:
+  ansible.builtin.template:
-    src: 'my.cnf.j2'
+    src: my.cnf.j2
-    dest: '{{ mysql_user_home }}/.my.cnf'
+    dest: "{{ mysql_user_home }}/.my.cnf"
-    mode: '0400'
+    mode: "0400"
  tags: my_cnf
- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database
- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
  community.mysql.mysql_user:
-    name: ''
+    name: ""
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users
- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
  community.mysql.mysql_query:
-    query:
+    query: >
-      - DELETE
+      DELETE
-        FROM mysql.user
+      FROM mysql.user
-        WHERE USER='root'
+      WHERE USER='root'
-          AND HOST NOT IN ('localhost',
+        AND HOST NOT IN ('localhost',
-                          '127.0.0.1',
+                         '127.0.0.1',
-                          '::1')
+                         '::1');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root
- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
-        FROM mysql.user
+      FROM mysql.user
-        WHERE (length(authentication_string)=0
+      WHERE (length(authentication_string)=0
-              OR authentication_string="")
+             OR authentication_string="")
-          AND USER NOT IN ('mysql.sys',
+        AND USER NOT IN ('mysql.sys',
-                          'mysqlxsys',
+                         'mysqlxsys',
-                          'mariadb.sys');
+                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords_or_auth_string
-  when:
+  check_mode: false
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+  when: >
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full
    is version('10.4.0', '>='))
- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
-        FROM mysql.user
+      FROM mysql.user
-        WHERE (length(password)=0
+      WHERE (length(password)=0
-              OR password="")
+             OR password="")
-          AND (length(authentication_string)=0
+        AND (length(authentication_string)=0
-              OR authentication_string="")
+             OR authentication_string="")
-          AND USER NOT IN ('mysql.sys',
+        AND USER NOT IN ('mysql.sys',
-                          'mysqlxsys',
+                         'mysqlxsys',
-                          'mariadb.sys');
+                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords
-  when:
+  check_mode: false
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+  when: >
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full is
    version('10.4.0', '<'))
- name: create a fact for users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
  set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords_or_auth_string.query_result is defined
    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
 - name: create a fact for users without password
  set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords.query_result is defined
    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
 - name: ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
-      - "DROP USER {{ users_wo_auth }}"
+      - DROP USER {{ item.user }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
+  with_community.general.flattened:
-    - users_wo_auth is defined
+    - "{{ mysql_users_wo_passwords.query_result | default([]) }}"
-    - users_wo_auth != ""  # noqa empty-string-compare
+    - "{{ mysql_users_wo_passwords_or_auth_string.query_result | default([]) }}"
@@ -1,10 +1,10 @@
 ---
-mysql_daemon: mysql
+mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
@@ -1,4 +1,4 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
@@ -1,10 +1,10 @@
 ---
 mysql_daemon: mysql-server
-mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /usr/local/etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /usr/local/etc/mysql/conf.d
-mysql_hardening_group: 'mysql'
+mysql_hardening_group: mysql
-mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /usr/local/etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /usr/local/etc/mysql/*.cnf files
@@ -1,7 +1,7 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
@@ -1,9 +1,9 @@
 ---
 mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
-mysql_hardening_group: 'mysql'
+mysql_hardening_group: mysql
@@ -0,0 +1,10 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'
@@ -1,10 +1,10 @@
 ---
 mysql_daemon: mysql
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
@@ -1,3 +1,2 @@
 ---
-
+mysql_hardening_user: mysql # owner of data
 mysql_hardening_user: 'mysql'  # owner of data
@@ -1,20 +1,20 @@
 ---
-nginx_client_body_buffer_size: '1k'
+nginx_client_body_buffer_size: 1k
 nginx_remove_default_site: true
-nginx_client_max_body_size: '1k'
+nginx_client_max_body_size: 1k
-nginx_keepalive_timeout: '5 5'
+nginx_keepalive_timeout: 5 5
-nginx_server_tokens: 'off'
+nginx_server_tokens: "off"
-nginx_client_header_buffer_size: "1k"
+nginx_client_header_buffer_size: 1k
-nginx_large_client_header_buffers: "2 1k"
+nginx_large_client_header_buffers: 2 1k
 nginx_client_body_timeout: "10"
 nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
-nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
+nginx_limit_conn_zone: $binary_remote_addr zone=default:10m
-nginx_limit_conn: "default 5"
+nginx_limit_conn: default 5
-nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_dir: /etc/nginx
-nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: /etc/nginx
-nginx_owner_user: "root"
+nginx_owner_user: root
-nginx_owner_group: "root"
+nginx_owner_group: root
 nginx_add_header:
  # avoid clickjacking
  - X-Frame-Options SAMEORIGIN
@@ -27,7 +27,8 @@ nginx_add_header:
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
+nginx_ssl_protocols: TLSv1.2 TLSv1.3
-nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
+# yamllint disable-line rule:line-length
 nginx_ssl_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
 nginx_ssl_session_tickets: "off"
 nginx_dh_size: "4096"
@@ -1,5 +1,5 @@
 ---
 - name: Restart nginx
-  service:
+  ansible.builtin.service:
-    name: "nginx"
+    name: nginx
    state: restarted
@@ -1,15 +1,16 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
+  description: This Ansible role provides secure nginx configurations. http://dev-sec.io/
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
        - "7"
        - "8"
        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -19,6 +20,7 @@ galaxy_info:
      versions:
        - buster
        - bullseye
    - name: Amazon
  galaxy_tags:
    - system
    - security
@@ -1,81 +1,81 @@
 ---
 - name: Create additional configuration
-  template:
+  ansible.builtin.template:
-    src: "hardening.conf.j2"
+    src: hardening.conf.j2
    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
-    mode: '0600'
+    mode: "0600"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change configuration in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*server_tokens'
+    regexp: ^\s*server_tokens
    line: "    server_tokens {{ nginx_server_tokens }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_protocols in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_protocols'
+    regexp: ^\s*ssl_protocols
    line: "    ssl_protocols {{ nginx_ssl_protocols }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_prefer_server_ciphers in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_prefer_server_ciphers'
+    regexp: ^\s*ssl_prefer_server_ciphers
    line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_max_body_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_max_body_size'
+    regexp: ^\s*client_max_body_size
    line: "    client_max_body_size {{ nginx_client_max_body_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_body_buffer_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_body_buffer_size'
+    regexp: ^\s*client_body_buffer_size
    line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change keepalive_timeout in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*keepalive_timeout'
+    regexp: ^\s*keepalive_timeout
    line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Remove default.conf
-  file:
+  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  when: nginx_remove_default_site
@@ -85,10 +85,10 @@
    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 - name: Generate dh group
-  openssl_dhparam:
+  community.crypto.openssl_dhparam:
    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
-    mode: '0640'
+    mode: "0640"
    owner: "{{ nginx_owner_user }}"
    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
@@ -54,7 +54,7 @@
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
@@ -118,7 +118,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -193,7 +193,7 @@
 **Fixed bugs:**
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
@@ -374,7 +374,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) ([fitz123](https://github.com/fitz123))
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 **Fixed bugs:**
@@ -487,7 +487,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -58,7 +58,7 @@ If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip f
 ### hidepid on RHEL/CentOS 7
-When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, everytime someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
+When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
 ```
 Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
@@ -107,6 +107,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
 - `os_auth_pw_warn_age`
  - Default: `7`
  - Description: number of days of warning before password expires.
 - `os_auth_pw_remember`
  - Default: `5`
  - Description: how many used passwords are record.
@@ -131,12 +134,16 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pam_sssd_enable`
  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
  - Description: activate PAM auth support for sssd
 - `os_auth_pam_oddjob_mkhomedir`
  - Default: `false`
  - Description: Enables automatic homedir e.g. in FreeIPA environments
 - `os_security_users_allow`
  - Default: `[]`
  - Description: list of things, that a user is allowed to do. May contain `change_user`.
 - `os_security_kernel_enable_module_loading`
  - Default: `true`
  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`).
  - WARNING: Rebuilding initramfs is deprecated and will be removed in the next major release. For more information take a look at this issue: <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
 - `os_security_kernel_enable_core_dump`
  - Default: `false`
  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
@@ -212,12 +219,18 @@ We know that this is the case on Raspberry Pi.
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring auditd.
 - `os_auditd_template`
  - Default: `etc/audit/auditd.conf.j2`
  - Description: Template file to use for auditd.conf. By overwriting this value, a custom auditd.conf template can be provided. Put a `templates` directory next to your playbook with a custom template in it (e.q. `myauditd.conf.j2`) and set this variable to your template.
 - `os_auditd_max_log_file_action`
  - Default: `keep_logs`
  - Description: Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`.
 - `os_auditd_max_log_file`
  - Default: `6`
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action. The value given must be numeric.
 - `os_auditd_num_logs`
  - Default: `5`
  - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
 - `hidepid_option`
  - Default: `2` (on RHEL/CentOS7 `0`, see known limitations)
  - Description: `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc.
@@ -227,9 +240,27 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_users`
  - Default: `['vagrant', 'kitchen']`
  - Description: Specify system accounts whose login should not be disabled and password not changed
 - `os_chmod_home_folders`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of home folders for regular users
 - `os_ignore_home_folder_users`
-  - Default: `lost+found`
+  - Default: `[]`
-  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+  - Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 - `os_chmod_rootuser_home_folder`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of root's home folder
 - `os_rootuser_pw_ageing`
  - Default: `false`
  - Description: Set to true to enforce password age settings for root user(s)
 - `os_remove_additional_root_users`
  - Default: `false`
  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_user_pw_ageing`
  - Default: `true`
  - Description: Set to false to disable password age enforcement on existing users
 - `os_users_without_password_ageing`
  - Default: `[]`
  - Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 - `os_cron_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring cron.
@@ -241,7 +272,7 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
  - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring minimize_access.
@@ -287,6 +318,42 @@ We know that this is the case on Raspberry Pi.
 - `os_sha_crypt_max_rounds`
  - Default: `640000`
  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring `auditd`.
 - `os_auditd_flush`
  - Default: `INCREMENTAL`
  - Description: Valid values are none, incremental, incremental_async, data, and sync.
 - `os_auditd_freq`
  - Default: `20`
  - Description: Specify number of records to write before issuing an explicit flush to disk command. This value is only valid when the flush keyword is set to incremental or incremental_async.
 - `os_auditd_max_log_file`
  - Default: 6
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action.
 - `os_auditd_max_log_file_action`
  - Default: `keep_logs`
  - Description: This parameter tells the system what action to take when the system has detected that the max file size limit has been reached. Valid values are ignore, syslog, suspend, rotate and keep_logs.
 - `os_auditd_write_logs`
  - Default: `true`
  - Description: Set to false in order to disable writing logs to disk.
 - `os_auditd_log_file`
  - Default: `/var/log/audit/audit.log`
  - Description: Specify the full path name to the log file where audit records will be stored. It must be a regular file.
 - `os_auditd_log_format`
  - Default: `RAW`
  - Description: The log format describes how the information should be stored on disk. There are 2 options: raw and enriched. If set to `RAW`, the audit records will be stored in a format exactly as the kernel sends it. The `ENRICHED` option will resolve all uid, gid, syscall, architecture, and socket address information before writing the event to disk. This aids in making sense of events created on one system but reported/analyzed on another system.
 - `os_auditd_admin_space_left`
  - Default: 50
  - Description: This is a numeric value in megabytes that tells the audit daemon when to perform a configurable action because the system is running low on disk space.
 - `os_auditd_space_left`
  - Default: 75
  - Description: If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by space_left_action.
 - `os_auditd_space_left_action`
  - Default: SYSLOG
  - Description: This parameter tells the system what action to take when the system has detected that it is starting to get low on disk space.
 - `os_auditd_action_mail_acct`
  - Default: root
  - Description: If `space_left_action` or `admin_space_left_action` are set to `email`, uses the address or alias to send the email using `/usr/lib/sendmail`. If the address or alias is not local, requires email properly configured on the machine and network.
 - `os_mnt_boot_dir_mode`
  - Default: `0700`
  - Description: Set default perimissions for /boot
@@ -2,28 +2,43 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
-os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_min_age: 7 # Discourage password cycling
-os_auth_pw_remember: 5  # Specify how many used passwords are record
+os_auth_pw_warn_age: 7
 os_auth_pw_remember: 5 # Specify how many used passwords are record
 os_auth_retries: 5
-os_auth_lockout_time: 600  # Seconds (600 = 10min)
+os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_oddjob_mkhomedir: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
+os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
+os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 os_chfn_restrict: ""
-os_chfn_restrict: ''
+# Set to `false` to disable "chmod 700" of home folders for regular users
-
+os_chmod_rootuser_home_folder: true
 # Set to false to disable chmod /home folders to 700
 os_chmod_home_folders: true
 # Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 os_ignore_home_folder_users: []
 # May contain: change_user
 os_security_users_allow: []
-# Specify user home folders in /home that shouldn't be chmodded to 700
+
-os_ignore_home_folder_users: ['lost+found']
+# Set to false to disable password age enforcement on existing users
 os_rootuser_pw_ageing: false
 # When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 os_remove_additional_root_users: false
 # Set to false to disable password age enforcement on existing users
 os_user_pw_ageing: true
 # List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 os_users_without_password_ageing: []
 # Specify system accounts whose login should not be disabled and password not changed
-os_ignore_users: ['vagrant', 'kitchen']
+os_ignore_users: [vagrant, kitchen]
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
@@ -35,8 +50,7 @@ os_security_suid_sgid_remove_from_unknown: false
 # Remove packages with known security issues
 os_security_packages_clean: true
-os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
+os_security_packages_list: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
 # Allow interactive startup (rhel, centos)
 os_security_init_prompt: true
 # Require root password for single user mode. (rhel, centos)
@@ -49,15 +63,15 @@ ufw_manage_defaults: true
 # By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
 # CAUTION!
 # If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
-ufw_ipt_sysctl: ''
+ufw_ipt_sysctl: ""
 # Default ufw variables
-ufw_default_input_policy: 'DROP'
+ufw_default_input_policy: DROP
-ufw_default_output_policy: 'ACCEPT'
+ufw_default_output_policy: ACCEPT
-ufw_default_forward_policy: 'DROP'
+ufw_default_forward_policy: DROP
-ufw_default_application_policy: 'SKIP'
+ufw_default_application_policy: SKIP
-ufw_manage_builtins: 'no'
+ufw_manage_builtins: "no"
-ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
+ufw_ipt_modules: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
 # Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted).
@@ -144,8 +158,8 @@ sysctl_config:
  # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
  #
  # For applications launching crash handlers that need PTRACE, exceptions can
-  # be registered by the debugee by declaring in the segfault handler
+  # be registered by the debuggee by declaring in the segfault handler
-  # specifically which process will be using PTRACE on the debugee:
+  # specifically which process will be using PTRACE on the debuggee:
  #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
  #
  # In general, PTRACE is not needed for the average running Ubuntu system.
@@ -253,6 +267,7 @@ sysctl_config:
  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
  net.ipv6.conf.default.router_solicitations: 0
  net.ipv6.conf.all.router_solicitations: 0
  # Disable Accept Router Preference from router advertisement | sysctl-22
  net.ipv6.conf.default.accept_ra_rtr_pref: 0
@@ -265,6 +280,7 @@ sysctl_config:
  # Disable IPv6 autoconfiguration | sysctl-26
  net.ipv6.conf.default.autoconf: 0
  net.ipv6.conf.all.autoconf: 0
  # Disable neighbor solicitations to send out per address | sysctl-27
  net.ipv6.conf.default.dad_transmits: 0
@@ -291,35 +307,48 @@ sysctl_config:
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
 # Disable unused filesystems
 os_unused_filesystems:
-  - "cramfs"
+  - cramfs
-  - "freevxfs"
+  - freevxfs
-  - "jffs2"
+  - jffs2
-  - "hfs"
+  - hfs
-  - "hfsplus"
+  - hfsplus
-  - "squashfs"
+  - squashfs
-  - "udf"
+  - udf
-  - "vfat"
+  - vfat
  # Obsolete network protocols that should be disabled
  # per CIS Oracle Linux 6 Benchmark (2016)
-  - "dccp"  # CIS 3.5.1
+  - dccp # CIS 3.5.1
-  - "rds"   # CIS 3.5.3
+  - rds # CIS 3.5.3
-  - "sctp"  # CIS 3.5.2
+  - sctp # CIS 3.5.2
-  - "tipc"  # CIS 3.5.4
+  - tipc # CIS 3.5.4
 # Whitelist for used filesystems
 os_filesystem_whitelist: []
 # Set to false to turn the role into a no-op. Useful when using
 # the Ansible role dependency mechanism.
 os_hardening_enabled: true
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
 os_auditd_template: etc/audit/auditd.conf.j2
 os_auditd_flush: INCREMENTAL
 os_auditd_freq: 20
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
 os_auditd_write_logs: true
 os_auditd_log_file: /var/log/audit/audit.log
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
 os_auditd_space_left_action: SYSLOG
 os_auditd_admin_space_left_action: SUSPEND
 os_auditd_disk_full_action: SUSPEND
 os_auditd_disk_error_action: SUSPEND
 os_auditd_action_mail_acct: root
 os_auditd_log_group: root
 os_auditd_num_logs: 5
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
@@ -327,7 +356,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true
@@ -338,7 +367,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 # Set to false to disable installing and configuring minimize_access.
@@ -373,7 +402,6 @@ os_yum_enabled: true
 # List of yum repository files under /etc/yum.repos.d/ which should not be altered.
 os_yum_repo_file_whitelist: []
 # Set to false to disable installing and configuring apt.
 os_apt_enabled: true
@@ -386,82 +414,82 @@ os_selinux_enabled: true
 os_sha_crypt_min_rounds: "640000"
 os_sha_crypt_max_rounds: "640000"
-os_mnt_boot_dir_mode: '0700'
+os_mnt_boot_dir_mode: "0700"
 os_mnt_boot_enabled: false
 os_mnt_boot_src: ""
-os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
+os_mnt_boot_options: rw,nosuid,nodev,noexec
 os_mnt_boot_filesystem: ""
 os_mnt_boot_dump: ""
 os_mnt_boot_passno: ""
-os_mnt_dev_dir_mode: '0755'
+os_mnt_dev_dir_mode: "0755"
 os_mnt_dev_enabled: true
-os_mnt_dev_src: "devtmpfs"
+os_mnt_dev_src: devtmpfs
-os_mnt_dev_options: 'rw,nosuid,noexec'
+os_mnt_dev_options: rw,nosuid,noexec
-os_mnt_dev_filesystem: "devtmpfs"
+os_mnt_dev_filesystem: devtmpfs
 os_mnt_dev_dump: ""
 os_mnt_dev_passno: ""
-os_mnt_dev_shm_dir_mode: '1777'
+os_mnt_dev_shm_dir_mode: "1777"
 os_mnt_dev_shm_enabled: true
-os_mnt_dev_shm_src: "tmpfs"
+os_mnt_dev_shm_src: tmpfs
-os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
+os_mnt_dev_shm_options: rw,nosuid,nodev,noexec
-os_mnt_dev_shm_filesystem: "tmpfs"
+os_mnt_dev_shm_filesystem: tmpfs
 os_mnt_dev_shm_dump: ""
 os_mnt_dev_shm_passno: ""
-os_mnt_home_dir_mode: '0755'
+os_mnt_home_dir_mode: "0755"
 os_mnt_home_enabled: false
 os_mnt_home_src: ""
-os_mnt_home_options: 'rw,nosuid,nodev'
+os_mnt_home_options: rw,nosuid,nodev
 os_mnt_home_filesystem: ""
 os_mnt_home_dump: ""
 os_mnt_home_passno: ""
-os_mnt_run_dir_mode: '0755'
+os_mnt_run_dir_mode: "0755"
 os_mnt_run_enabled: true
-os_mnt_run_src: "tmpfs"
+os_mnt_run_src: tmpfs
-os_mnt_run_options: 'rw,nosuid,nodev'
+os_mnt_run_options: rw,nosuid,nodev
-os_mnt_run_filesystem: "tmpfs"
+os_mnt_run_filesystem: tmpfs
 os_mnt_run_dump: ""
 os_mnt_run_passno: ""
-os_mnt_tmp_dir_mode: '1777'
+os_mnt_tmp_dir_mode: "1777"
 os_mnt_tmp_enabled: false
 os_mnt_tmp_src: ""
-os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_tmp_filesystem: ""
 os_mnt_tmp_dump: ""
 os_mnt_tmp_passno: ""
-os_mnt_var_dir_mode: '0755'
+os_mnt_var_dir_mode: "0755"
 os_mnt_var_enabled: false
 os_mnt_var_src: ""
-os_mnt_var_options: 'rw,nosuid,nodev'
+os_mnt_var_options: rw,nosuid,nodev
 os_mnt_var_filesystem: ""
 os_mnt_var_dump: ""
 os_mnt_var_passno: ""
-os_mnt_var_log_dir_mode: '0755'
+os_mnt_var_log_dir_mode: "0755"
 os_mnt_var_log_enabled: false
 os_mnt_var_log_src: ""
-os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_filesystem: ""
 os_mnt_var_log_dump: ""
 os_mnt_var_log_passno: ""
-os_mnt_var_log_audit_dir_mode: '0700'
+os_mnt_var_log_audit_dir_mode: "0700"
 os_mnt_var_log_audit_enabled: false
 os_mnt_var_log_audit_src: ""
-os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_audit_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_audit_filesystem: ""
 os_mnt_var_log_audit_dump: ""
 os_mnt_var_log_audit_passno: ""
-os_mnt_var_tmp_dir_mode: '1777'
+os_mnt_var_tmp_dir_mode: "1777"
 os_mnt_var_tmp_enabled: false
 os_mnt_var_tmp_src: ""
-os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_var_tmp_filesystem: ""
 os_mnt_var_tmp_dump: ""
 os_mnt_var_tmp_passno: ""
@@ -1,19 +1,18 @@
 ---
- name: Update-initramfs
+- name: Update-initramfs # noqa no-changed-when
-  command: 'update-initramfs -u'
+  ansible.builtin.command: update-initramfs -u
- name: restart-auditd
+- name: Restart auditd # noqa command-instead-of-module no-changed-when
-  command:
+  ansible.builtin.command:
-    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
+  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
  when: molecule_yml is not defined  # restarting auditd in a container does not work
 - name: Reload systemd
-  systemd:
+  ansible.builtin.systemd:
    daemon_reload: true
 - name: Remount filesystems
-  mount:
+  ansible.posix.mount:
    path: "{{ item }}"
    state: remounted
  loop: "{{ mountpoints_changed }}"
@@ -1,15 +1,16 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
+  description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: "2.11"
  platforms:
    - name: EL
      versions:
        - "7"
        - "8"
        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -1,7 +1,7 @@
 ---
 - name: Remove deprecated or insecure packages | package-01 - package-09
-  apt:
+  ansible.builtin.apt:
-    name: '{{ os_security_packages_list }}'
+    name: "{{ os_security_packages_list }}"
-    state: 'absent'
+    state: absent
-    purge: 'yes'
+    purge: true
  when: os_security_packages_clean | bool
@@ -1,16 +1,16 @@
 ---
 - name: Install auditd package | package-08
-  package:
+  ansible.builtin.package:
-    name: '{{ auditd_package }}'
+    name: "{{ auditd_package }}"
-    state: 'present'
+    state: present
  tags: auditd
 - name: Configure auditd | package-08
-  template:
+  ansible.builtin.template:
-    src: 'etc/audit/auditd.conf.j2'
+    src: "{{ os_auditd_template }}"
-    dest: '/etc/audit/auditd.conf'
+    dest: /etc/audit/auditd.conf
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0640'
+    mode: "0640"
-  notify: 'restart-auditd'
+  notify: Restart auditd
  tags: auditd
@@ -6,7 +6,7 @@
 # CIS 5.1.2 - CIS 5.1.7
 #
 - name: Find cron files and directories
-  find:
+  ansible.builtin.find:
    paths:
      - /etc
    patterns:
@@ -1,6 +1,6 @@
 ---
 - name: Disable CTRL-ALT-DEL
-  systemd:
+  ansible.builtin.systemd:
    name: ctrl-alt-del.target
    masked: true
    daemon_reload: true
@@ -1,101 +1,129 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
- import_tasks: auditd.yml
+- name: Import tasks for auditd
  ansible.builtin.import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool
- import_tasks: cron.yml
+- name: Import tasks for cron
  ansible.builtin.import_tasks: cron.yml
  tags: cron
  when: os_cron_enabled | bool
- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
  ansible.builtin.import_tasks: ctrlaltdel.yml
  tags: ctrlaltdel
  when: os_ctrlaltdel_disabled | bool
- import_tasks: limits.yml
+- name: Import tasks to configure limits
  ansible.builtin.import_tasks: limits.yml
  tags: limits
  when: os_limits_enabled | bool
- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
  ansible.builtin.import_tasks: login_defs.yml
  tags: login_defs
  when: os_login_defs_enabled | bool
- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
  ansible.builtin.import_tasks: minimize_access.yml
  tags: minimize_access
  when: os_minimize_access_enabled | bool
- import_tasks: pam.yml
+- name: Import tasks to configure PAM
  ansible.builtin.import_tasks: pam.yml
  tags: pam
  when: os_pam_enabled | bool
- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
  ansible.builtin.import_tasks: modprobe.yml
  tags: modprobe
  when: os_modprobe_enabled | bool
- import_tasks: profile.yml
+- name: Import tasks to configure profile
  ansible.builtin.import_tasks: profile.yml
  tags: profile
  when: os_profile_enabled | bool
- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
  ansible.builtin.import_tasks: securetty.yml
  tags: securetty
  when: os_securetty_enabled | bool
- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
  ansible.builtin.import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
  tags: suid_sgid
- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
  ansible.builtin.import_tasks: sysctl.yml
  tags: sysctl
  when: os_sysctl_enabled | bool
- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
  ansible.builtin.import_tasks: user_accounts.yml
  tags: user_accounts
  when: os_user_accounts_enabled | bool
- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
  ansible.builtin.import_tasks: rhosts.yml
  tags: rhosts
  when: os_rhosts_enabled | bool
- import_tasks: netrc.yml
+- name: Import tasks to configure netrc
  ansible.builtin.import_tasks: netrc.yml
  tags: netrc
  when: os_netrc_enabled | bool
- import_tasks: yum.yml
+- name: Import tasks to configure yum
  ansible.builtin.import_tasks: yum.yml
  tags: yum
  when:
    - ansible_facts.os_family == 'RedHat'
    - os_yum_enabled | bool
- import_tasks: apt.yml
+- name: Import tasks to configure apt
  ansible.builtin.import_tasks: apt.yml
  tags: apt
  when:
    - ansible_facts.os_family == 'Debian'
    - os_apt_enabled | bool
- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
  ansible.builtin.import_tasks: selinux.yml
  tags: selinux
  when:
    - ansible_facts.selinux.status == 'enabled'
    - os_selinux_enabled | bool
 - name: Raise deprecation warning for initramfs tasks  # noqa ignore-errors
  ansible.builtin.fail:
    msg: "WARNING: Rebuilding initramfs is deprecated and will be removed
          in the next major release. For more information take a look at this issue:
          https://github.com/dev-sec/ansible-collection-hardening/pull/591"
  when:
    - os_security_kernel_enable_module_loading
  ignore_errors: true
  tags: always
@@ -1,65 +1,65 @@
 ---
- name: disable coredumps
+- name: Disable coredumps
  block:
  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
      path: '/etc/security/limits.d'
      owner: 'root'
      group: 'root'
      mode: '0755'
      state: 'directory'
  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
    pam_limits:
      dest: '/etc/security/limits.d/10.hardcore.conf'
      domain: '*'
      limit_type: hard
      limit_item: core
      value: '0'
      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
  - name: Set 10.hardcore.conf perms to 0400 and root ownership
    file:
      path: /etc/security/limits.d/10.hardcore.conf
      owner: 'root'
      group: 'root'
      mode: '0440'
      state: touch
      modification_time: preserve
      access_time: preserve
  - name: create coredump.conf.d-directory if it does not exist
    file:
      path: '/etc/systemd/coredump.conf.d'
      owner: root
      group: root
      mode: 0755
      state: directory
    when: ansible_service_mgr == "systemd"
  - name: create custom.conf for disabling coredumps
    template:
      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
      dest: '/etc/systemd/coredump.conf.d/custom.conf'
      owner: root
      group: root
      mode: 0644
    when: ansible_service_mgr == "systemd"
    notify: Reload systemd
  when: not os_security_kernel_enable_core_dump | bool
  block:
    - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
      ansible.builtin.file:
        path: /etc/security/limits.d
        owner: root
        group: root
        mode: "0755"
        state: directory
- name: enable coredumps
+    - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
      community.general.pam_limits:
        dest: /etc/security/limits.d/10.hardcore.conf
        domain: "*"
        limit_type: hard
        limit_item: core
        value: "0"
        comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
      when: not ansible_check_mode  # the directory needs to be created first, which does not happen in check_mode
    - name: Set 10.hardcore.conf perms to 0400 and root ownership
      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
        owner: root
        group: root
        mode: "0440"
        state: touch
        modification_time: preserve
        access_time: preserve
    - name: Create coredump.conf.d-directory if it does not exist
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        owner: root
        group: root
        mode: "0755"
        state: directory
      when: ansible_service_mgr == "systemd"
    - name: Create custom.conf for disabling coredumps
      ansible.builtin.template:
        src: etc/systemd/coredump.conf.d/coredumps.conf.j2
        dest: /etc/systemd/coredump.conf.d/custom.conf
        owner: root
        group: root
        mode: "0644"
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
 - name: Enable coredumps
  when: os_security_kernel_enable_core_dump | bool
  block:
    - name: Remove coredump.conf.d directory with files
-      file:
+      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        state: absent
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
    - name: Remove 10.hardcore.conf config file
-      file:
+      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
        state: absent
  when: os_security_kernel_enable_core_dump | bool
@@ -1,8 +1,8 @@
 ---
 - name: Create login.defs | os-05, os-05b
-  template:
+  ansible.builtin.template:
-    src: 'etc/login.defs.j2'
+    src: etc/login.defs.j2
-    dest: '/etc/login.defs'
+    dest: /etc/login.defs
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0444'
+    mode: "0444"
@@ -1,5 +1,6 @@
 ---
- include_tasks: hardening.yml
+- name: Include hardening tasks
  ansible.builtin.include_tasks: hardening.yml
  when: os_hardening_enabled | bool
  tags:
    - always
`@@ -1,2 +1,2 @@`
	`---`	`---`
	`requires_ansible: '>=2.9.10'`	`requires_ansible: ">=2.9.10"`