set ansible python interpreter in converge-step, too

Signed-off-by: Sebastian Gumprich <[email protected]>

.config/ansible-lint.yml

@@ -11,6 +11,7 @@ exclude_paths:
 
 skip_list:
   - fqcn-builtins
+  - name[template]
 
 mock_roles:
   - geerlingguy.git

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,49 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Actual behavior**
-
-<!--- Paste verbatim command output between quotes -->
-
-```paste below
-
-```
-
-**Example Playbook**
-
-<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
-
-```paste below
-
-```
-
-**OS / Environment**
-
-<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
-
-**Ansible Version**
-
-<!--- Paste verbatim output from "ansible --version" between quotes -->
-
-```paste below
-
-```
-
-**Role Version**
-
-<!--- Paste version of the role between quotes -->
-
-```paste below
-
-```
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+---
+# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
+name: "Bug report"
+description: "Create a report to help us improve."
+labels: [
+  "bug"
+]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Reporting Bugs ld follow some simple rules:
+
+        - **Check**, if you can find similar bugs
+        - **Describe** what is happening and what should happen
+        - **Explain** how to reproduce the problem
+        - **Add** more details and attachments
+        - **Follow up**, if somebody is having questions or needs more details
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Description"
+      description: Describe the bug
+      placeholder: A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reprod
+    attributes:
+      label: "Reproduction steps"
+      render: Shell
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: currentbehavior
+    attributes:
+      label: "Current Behavior"
+      description: Please describe the results you received
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expectedbehavior
+    attributes:
+      label: "Expected Behavior"
+      description: Please describe the results you expect
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: os
+    attributes:
+      label: "OS / Environment"
+      value: |
+        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: ansible
+    attributes:
+      label: "Ansible Version"
+      render: Shell
+      value: |
+        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
+    validations:
+      required: true
+
+  - type: textarea
+    id: collection
+    attributes:
+      label: "Collection Version"
+      render: Shell
+      value: |
+        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: "Additional information"
+      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
+      value: |
+        ...
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,16 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,55 @@
+---
+# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
+name: "Feature request"
+description: "Suggest an idea for this project."
+labels: [
+  "enhancement"
+]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Requesting a new feature or enhancement is following some simple rules:
+
+        - **Check**, if the feature is already requested
+        - **Describe** what your feature will bring to the community
+        - **Explain** the criteria to fulfill the request
+        - **Add** more details like mock ups, attachments, lists, screenshots
+        - **Follow Up** in the discussion to the feature
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Description"
+      description: Is your feature request related to a problem? Please describe.
+      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: "Solution"
+      description: Describe the solution you'd like
+      placeholder: A clear and concise description of what you want to happen.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: "Alternatives"
+      description: Describe alternatives you've considered
+      placeholder: A clear and concise description of any alternative solutions or features you've considered.
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: "Additional information"
+      description: Add any other context or screenshots about the feature request here.
+      value: |
+        ...
+    validations:
+      required: false

.github/workflows/mysql_hardening.yml

@@ -37,7 +37,7 @@ jobs:
           - debian11
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo

.github/workflows/os_hardening_vm.yml

@@ -25,17 +25,17 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centosstream8
-          - centosstream9
+          - centos8s
+          # - centos9s  # problems with vagrant
           - rocky8
-          - rocky9
+          # - rocky9  # problems with vagrant
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204
           - debian10
           - debian11
           # - opensuse42  # opensuse currently cannot get an ip address
-          # - arch  - arch is currently not supported by cinc-auditor
+          # - arch  # arch is currently not supported by cinc-auditor
     steps:
       - name: Checkout repo
         uses: actions/checkout@v3

CHANGELOG.md

@@ -1,11 +1,38 @@
 # Changelog
 
-## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
+## [8.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.1) (2022-11-24)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.3.1)
+
+**Implemented enhancements:**
+
+- Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
+- OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
+- add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
+- use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
 
 **Fixed bugs:**
 
+- os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
+- ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
+- OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
+
+**Merged pull requests:**
+
+- Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
+- add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
+
+## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
+
+**Implemented enhancements:**
+
+- add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+
+**Fixed bugs:**
+
+- cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
 - do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
 
 **Closed issues:**
@@ -16,6 +43,8 @@
 
 **Merged pull requests:**
 
+- adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
@@ -43,7 +72,7 @@
 **Merged pull requests:**
 
 - update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)

CONTRIBUTING.md

@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 
 ## Expectations
 
+## Sign off Your Work
+
+The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
+[Here is the full text of the DCO](http://developercertificate.org/).
+Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
+
+```text
+This is my commit message
+
+Signed-off-by: Random J Developer <[email protected]>
+```
+
+Git even has a -s command line option to append this automatically to your commit message:
+
+```text
+git commit -s -m 'This is my commit message'
+```
+
 ### Don't reinvent the wheel
 
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.2.0
+version: 8.3.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/mysql_hardening/converge.yml

@@ -24,6 +24,19 @@
         - mysql_python_package_debian is not defined
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
+
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: install required python packages on Suse
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
+      args:
+        removes: /usr/bin/zypper
+
+
     - include_role:
         name: mysql_hardening
   vars:

molecule/mysql_hardening/prepare.yml

@@ -15,6 +15,12 @@
         - ansible_distribution == 'Debian'
         - ansible_distribution_major_version|int >= 11
 
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
     - name: Use Python 2 on Debian 10
       set_fact:
         ansible_python_interpreter: /usr/bin/python
@@ -29,12 +35,6 @@
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
-      community.general.zypper:
-        name: "python-xml"
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
     - name: create missing directory
       file:
         path: "/etc/mysql/conf.d"

molecule/os_hardening_vm/prepare.yml

@@ -16,8 +16,6 @@
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       apt:
-        name: "*"
-        state: latest
         update_cache: true
       when: ansible_os_family == 'Debian'
 

molecule/ssh_hardening/verify.yml

@@ -42,7 +42,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

roles/mysql_hardening/README.md

@@ -16,6 +16,7 @@ It configures:
 
 - Ansible 2.9.0
 - An existing MySQL installation
+- python-jmespath on the ansible host
 
 ### Example playbook
 

roles/mysql_hardening/tasks/main.yml

@@ -59,12 +59,14 @@
     - mysql_version.version.full is version('8.0.3', '>=')
     - mysql_distribution == "mysql"
 
-- include: configure.yml
+- name: Include tasks for configuration
+  import_tasks: configure.yml
   when: mysql_hardening_enabled | bool
   tags:
     - mysql_hardening
 
-- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
+  import_tasks: mysql_secure_installation.yml
   when: mysql_hardening_enabled | bool
   tags:
     - mysql_hardening

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -4,7 +4,7 @@
     msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
-- name: ensure that the root password is present
+- name: Ensure that the root password is present
   community.mysql.mysql_user:
     name: 'root'
     host_all: true
@@ -19,14 +19,14 @@
     mode: '0400'
   tags: my_cnf
 
-- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
   community.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
-- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
   community.mysql.mysql_user:
     name: ''
     state: absent
@@ -34,7 +34,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_anonymous_users
 
-- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
   community.mysql.mysql_query:
     query:
       - DELETE
@@ -46,7 +46,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
 
-- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
   community.mysql.mysql_query:
     query:
       - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -62,7 +62,7 @@
     - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
       (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
 
-- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
   community.mysql.mysql_query:
     query:
       - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -80,21 +80,21 @@
     - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
       (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
 
-- name: create a fact for users without password or authentication_string
+- name: Create a fact for users without password or authentication_string
   set_fact:
     users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
   when:
     - mysql_users_wo_passwords_or_auth_string.query_result is defined
     - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
 
-- name: create a fact for users without password
+- name: Create a fact for users without password
   set_fact:
     users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
   when:
     - mysql_users_wo_passwords.query_result is defined
     - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
 
-- name: ensure that there are no users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
   community.mysql.mysql_query:
     query:
       - "DROP USER {{ users_wo_auth }}"

roles/mysql_hardening/vars/Suse.yml

@@ -0,0 +1,10 @@
+---
+mysql_daemon: mariadb
+mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+
+mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
+
+mysql_hardening_group: 'mysql'
+login_unix_socket: '/run/mysql/mysql.sock'

roles/os_hardening/README.md

@@ -230,6 +230,15 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_home_folder_users`
   - Default: `lost+found`
   - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_chmod_rootuser_home_folder`
+  - Default: `true`
+  - Description: Set to `false` to disable "chmod 700" of root's home folder
+- `os_rootuser_pw_ageing`
+  - Default: `false`
+  - Description: Set to true to enforce password age settings for root user(s)
+- `os_remove_additional_root_users`
+  - Default: `false`
+  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_cron_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring cron.
@@ -241,7 +250,7 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
   - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring minimize_access.

roles/os_hardening/defaults/main.yml

@@ -15,13 +15,21 @@ os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
 
-# Set to false to disable chmod /home folders to 700
+# Set to false to disable chmod userhome folders to 700
+os_chmod_rootuser_home_folder: true
 os_chmod_home_folders: true
 
 # May contain: change_user
 os_security_users_allow: []
 # Specify user home folders in /home that shouldn't be chmodded to 700
 os_ignore_home_folder_users: ['lost+found']
+
+# Set to false to disable password age enforcement on existing users
+os_rootuser_pw_ageing: false
+
+# When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
+os_remove_additional_root_users: false
+
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
@@ -338,7 +346,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
 
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 
 # Set to false to disable installing and configuring minimize_access.

roles/os_hardening/handlers/main.yml

@@ -1,19 +1,18 @@
 ---
 - name: Update-initramfs
-  command: 'update-initramfs -u'
+  ansible.builtin.command: 'update-initramfs -u'
 
-- name: restart-auditd
-  command:
+- name: Restart auditd
+  ansible.builtin.command:
     cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
-    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
   when: molecule_yml is not defined  # restarting auditd in a container does not work
 
 - name: Reload systemd
-  systemd:
+  ansible.builtin.systemd:
     daemon_reload: true
 
 - name: Remount filesystems
-  mount:
+  ansible.posix.mount:
     path: "{{ item }}"
     state: remounted
   loop: "{{ mountpoints_changed }}"

roles/os_hardening/tasks/auditd.yml

@@ -12,5 +12,5 @@
     owner: 'root'
     group: 'root'
     mode: '0640'
-  notify: 'restart-auditd'
+  notify: Restart auditd
   tags: auditd

roles/os_hardening/tasks/hardening.yml

@@ -22,79 +22,97 @@
   with_dict: '{{ os_vars }}'
   tags: always
 
-- import_tasks: auditd.yml
+- name: Import tasks for auditd
+  import_tasks: auditd.yml
   tags: auditd
   when: os_auditd_enabled | bool
 
-- import_tasks: cron.yml
+- name: Import tasks for cron
+  import_tasks: cron.yml
   tags: cron
   when: os_cron_enabled | bool
 
-- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
+  import_tasks: ctrlaltdel.yml
   tags: ctrlaltdel
   when: os_ctrlaltdel_disabled | bool
 
-- import_tasks: limits.yml
+- name: Import tasks to configure limits
+  import_tasks: limits.yml
   tags: limits
   when: os_limits_enabled | bool
 
-- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
+  import_tasks: login_defs.yml
   tags: login_defs
   when: os_login_defs_enabled | bool
 
-- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
+  import_tasks: minimize_access.yml
   tags: minimize_access
   when: os_minimize_access_enabled | bool
 
-- import_tasks: pam.yml
+- name: Import tasks to configure PAM
+  import_tasks: pam.yml
   tags: pam
   when: os_pam_enabled | bool
 
-- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
+  import_tasks: modprobe.yml
   tags: modprobe
   when: os_modprobe_enabled | bool
 
-- import_tasks: profile.yml
+- name: Import tasks to configure profile
+  import_tasks: profile.yml
   tags: profile
   when: os_profile_enabled | bool
 
-- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
+  import_tasks: securetty.yml
   tags: securetty
   when: os_securetty_enabled | bool
 
-- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
+  import_tasks: suid_sgid.yml
   when: os_security_suid_sgid_enforce  | bool
   tags: suid_sgid
 
-- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
+  import_tasks: sysctl.yml
   tags: sysctl
   when: os_sysctl_enabled | bool
 
-- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
+  import_tasks: user_accounts.yml
   tags: user_accounts
   when: os_user_accounts_enabled | bool
 
-- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
+  import_tasks: rhosts.yml
   tags: rhosts
   when: os_rhosts_enabled | bool
 
-- import_tasks: netrc.yml
+- name: Import tasks to configure netrc
+  import_tasks: netrc.yml
   tags: netrc
   when: os_netrc_enabled | bool
 
-- import_tasks: yum.yml
+- name: Import tasks to configure yum
+  import_tasks: yum.yml
   tags: yum
   when:
     - ansible_facts.os_family == 'RedHat'
     - os_yum_enabled | bool
 
-- import_tasks: apt.yml
+- name: Import tasks to configure apt
+  import_tasks: apt.yml
   tags: apt
   when:
     - ansible_facts.os_family == 'Debian'
     - os_apt_enabled | bool
 
-- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
+  import_tasks: selinux.yml
   tags: selinux
   when:
     - ansible_facts.selinux.status == 'enabled'

roles/os_hardening/tasks/limits.yml

@@ -1,5 +1,6 @@
 ---
-- name: disable coredumps
+- name: Disable coredumps
+  when: not os_security_kernel_enable_core_dump | bool
   block:
   - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
@@ -28,7 +29,7 @@
       modification_time: preserve
       access_time: preserve
 
-  - name: create coredump.conf.d-directory if it does not exist
+  - name: Create coredump.conf.d-directory if it does not exist
     file:
       path: '/etc/systemd/coredump.conf.d'
       owner: root
@@ -37,7 +38,7 @@
       state: directory
     when: ansible_service_mgr == "systemd"
 
-  - name: create custom.conf for disabling coredumps
+  - name: Create custom.conf for disabling coredumps
     template:
       src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
       dest: '/etc/systemd/coredump.conf.d/custom.conf'
@@ -47,9 +48,8 @@
     when: ansible_service_mgr == "systemd"
     notify: Reload systemd
 
-  when: not os_security_kernel_enable_core_dump | bool
-
-- name: enable coredumps
+- name: Enable coredumps
+  when: os_security_kernel_enable_core_dump | bool
   block:
     - name: Remove coredump.conf.d directory with files
       file:
@@ -62,4 +62,3 @@
       file:
         path: /etc/security/limits.d/10.hardcore.conf
         state: absent
-  when: os_security_kernel_enable_core_dump | bool

roles/os_hardening/tasks/main.yml

@@ -1,5 +1,6 @@
 ---
-- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
   when: os_hardening_enabled | bool
   tags:
     - always

roles/os_hardening/tasks/pam.yml

@@ -17,11 +17,13 @@
   when:
     - ansible_facts.os_family != 'Archlinux'
 
-- import_tasks: pam_debian.yml
+- name: Import tasks for Debian PAM
+  import_tasks: pam_debian.yml
   when:
     - ansible_facts.os_family == 'Debian'
 
-- import_tasks: pam_rhel.yml
+- name: Import tasks for RedHat PAM
+  import_tasks: pam_rhel.yml
   when:
     - ansible_facts.os_family == 'RedHat'
 

roles/os_hardening/tasks/pam_debian.yml

@@ -22,9 +22,12 @@
     name: 'libpam-modules'
     state: 'present'
   when:
-    - os_auth_retries > 0
+    - os_auth_retries|int > 0
 
 - name: Manage tally on Debian stable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
   block:
     - name: Configure tally2
       template:
@@ -34,26 +37,26 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Delete tally2 when retries is 0
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
       when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+        - os_auth_retries|int == 0
 
 - name: Manage tally/faillock on Debian unstable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
   block:
     - name: Delete tally2
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
 
-    - name:  create tally directory
+    - name: Create tally directory
       file:
         path: '/var/run/faillock'
         state: 'directory'
@@ -77,7 +80,7 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Configure faillock pam authfail
       template:
@@ -87,24 +90,21 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Delete faillock when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock'
         state: 'absent'
       when:
-        - os_auth_retries == 0
+        - os_auth_retries|int == 0
 
     - name: Delete faillock authfail when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock_authfail'
         state: 'absent'
       when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+        - os_auth_retries|int == 0
 
 - name: Update pam on Debian systems
   command: 'pam-auth-update --package'

roles/os_hardening/tasks/sysctl.yml

@@ -42,6 +42,7 @@
   register: initramfs
 
 - name: Change sysctls
+  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
   block:
     - name: Create a combined sysctl-dict if os-dependent sysctls are defined
       set_fact:
@@ -69,7 +70,6 @@
         ignoreerrors: true
       with_dict: '{{ sysctl_config }}'
       when: item.key not in sysctl_unsupported_entries | default()
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults
   template:

roles/os_hardening/tasks/user_accounts.yml

@@ -1,4 +1,45 @@
 ---
+- name: Read local linux user database
+  getent:
+    database: passwd
+    # creates a dict for each user containing UID/HOMEDIR etc...
+  when: getent_passwd is undefined  # skip this task if "getent" has run before
+
+- name: Extract root account(s) from local user database
+  loop: "{{ getent_passwd.keys() | list }}"
+  when:
+    - getent_passwd[item][1]|int == 0
+  set_fact:
+    root_users: "{{ root_users | default([]) + [item] }}"
+
+- name: Set ownership of root user home directory(s) to 0700
+  file:
+    mode: 0700
+    owner: "{{ item }}"
+    path: "{{ getent_passwd[item][4] }}"
+    state: directory
+  loop: "{{ root_users }}"
+  when:
+    - os_chmod_rootuser_home_folder | bool
+
+- name: Set password ageing for root user(s)
+  user:
+    name: "{{ item }}"
+    password_expire_min: "{{ os_auth_pw_min_age }}"
+    password_expire_max: "{{ os_auth_pw_max_age }}"
+  loop: "{{ root_users }}"
+  when: os_rootuser_pw_ageing|bool
+
+- name: Remove additional users with UID=0 ("root" user is not touched)
+  user:
+    name: "{{ item }}"
+    state: absent
+  loop: "{{ root_users }}"
+  when:
+    - os_remove_additional_root_users|bool
+    - root_users|length > 1
+    - item != "root"
+
 - name: Get UID_MIN from login.defs
   shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
   args:
@@ -25,7 +66,7 @@
   when: uid_max is not defined
 
 - name: Get all system accounts
-  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
+  command: awk -F'':'' '{ if ( $3 <= {{ uid_max | quote }} ) print $1}' /etc/passwd
   args:
     removes: /etc/passwd
   changed_when: false
@@ -46,7 +87,7 @@
   with_community.general.flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
 
-- name: get all home directories in /home, but skip ignored users
+- name: Get all home directories in /home, but skip ignored users
   find:
     paths: /home/
     recurse: false
@@ -55,7 +96,7 @@
   register: home_directories
   when: os_chmod_home_folders | bool
 
-- name: set ownership of /home directories to 0700
+- name: Set ownership of /home directories to 0700
   file:
     mode: 0700
     path: "{{ item.path }}"

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -4,7 +4,7 @@
 #%PAM-1.0
 auth        required      pam_env.so
 auth        required      pam_faildelay.so delay=2000000
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -16,12 +16,12 @@ auth        sufficient    pam_unix.so nullok try_first_pass
 auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
 auth        sufficient    pam_sss.so forward_pass
 {% endif %}
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_deny.so
 
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
 account     required      pam_unix.so

roles/ssh_hardening/README.md

@@ -64,7 +64,7 @@ As this role requires root-privileges, we added `become: true` to all tasks. So
   - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
   - Default: `no`
-  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
+  - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
 - `ssh_gateway_ports`
   - Default: `false`
   - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.

roles/ssh_hardening/tasks/hardening.yml

@@ -5,9 +5,9 @@
     name: 'os_vars'
   with_first_found:
     - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
         - '{{ ansible_facts.distribution }}.yml'
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
         - '{{ ansible_facts.os_family }}.yml'
       skip: true
   tags: always

roles/ssh_hardening/tasks/main.yml

@@ -1,5 +1,6 @@
 ---
-- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
   args:
     apply:
       become: true

roles/ssh_hardening/tasks/selinux.yml

@@ -24,7 +24,7 @@
 # The following tasks only get executed when selinux is in state enforcing,
 # UsePam is 'no' and the ssh_password module is not installed. See this issue for
 # more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
-- name: run selinux tasks
+- name: Run selinux tasks
   when:
     - not (ssh_use_pam | bool)
     - ('ssh_password' not in ssh_password_module.stdout)

roles/ssh_hardening/templates/openssh.conf.j2

@@ -106,10 +106,13 @@ RSAAuthentication yes
 # Disable password-based authentication, it can allow for potentially easier brute-force attacks.
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
 
+{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
+{% if ansible_facts.os_family != 'OpenBSD' %}
 # Only use GSSAPIAuthentication if implemented on the network.
 GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
 GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
 
+{% endif %}
 # Disable tunneling
 Tunnel no
 

roles/ssh_hardening/templates/opensshd.conf.j2

@@ -143,10 +143,13 @@ KerberosTicketCleanup yes
 #KerberosGetAFSToken no
 {% endif %}
 
+{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
+{% if ansible_facts.os_family != 'OpenBSD' -%}
 # Only enable GSSAPI authentication if it is configured.
 GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
 GSSAPICleanupCredentials yes
 
+{% endif %}
 {% if ssh_deny_users %}
 # In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
 # For key-based authentication this is not necessary, since all keys must be explicitely enabled.
@@ -194,9 +197,9 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
 # Disable forwarding tcp connections.
 # no real advantage without denied shell access
 {% if sshd_version is version('6.2', '>=') %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
 {% else %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
 {% endif %}
 
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.