Merge pull request #657 from dev-sec/min_ansible_ver

Author: schurzi

roles/os_hardening/handlers/main.yml

@@ -1,8 +1,8 @@
 ---
-- name: Update-initramfs
+- name: Update-initramfs # noqa no-changed-when
   ansible.builtin.command: update-initramfs -u
 
-- name: Restart auditd # noqa command-instead-of-module
+- name: Restart auditd # noqa command-instead-of-module no-changed-when
   ansible.builtin.command:
     cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
   when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work

roles/os_hardening/meta/main.yml

@@ -4,7 +4,7 @@ galaxy_info:
   description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: 2.9.10
+  min_ansible_version: "2.11"
   platforms:
     - name: EL
       versions:

roles/os_hardening/tasks/limits.yml

@@ -35,7 +35,7 @@
         path: /etc/systemd/coredump.conf.d
         owner: root
         group: root
-        mode: 0755
+        mode: "0755"
         state: directory
       when: ansible_service_mgr == "systemd"
 
@@ -45,7 +45,7 @@
         dest: /etc/systemd/coredump.conf.d/custom.conf
         owner: root
         group: root
-        mode: 0644
+        mode: "0644"
       when: ansible_service_mgr == "systemd"
       notify: Reload systemd
 

roles/os_hardening/tasks/user_accounts.yml

@@ -53,7 +53,7 @@
 
 - name: Set ownership of root user home directory(s) to 0700
   ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
     owner: "{{ item }}"
     path: "{{ getent_passwd[item][4] }}"
     state: directory
@@ -100,7 +100,7 @@
 
 - name: Limit access to home directories of regular (non-system, non-root) accounts
   ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
     owner: "{{ item }}"
     path: "{{ getent_passwd[item][4] }}"
     state: directory

roles/ssh_hardening/tasks/hardening.yml

@@ -100,7 +100,7 @@
   check_mode: false
   when: ssh_server_hardening | bool
 
-- name: Remove all small primes
+- name: Remove all small primes # noqa no-changed-when
   ansible.builtin.shell: >
     awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ; [ -r {{ sshd_moduli_file }}.new
     -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true

roles/ssh_hardening/tasks/selinux.yml

@@ -57,7 +57,7 @@
 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
-- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when PAM is used, because allowing sshd to read the shadow file is considered a security risk # noqa no-changed-when
   ansible.builtin.command: semodule -r ssh_password
   when:
     - ssh_use_pam | bool