hardening: lint

roles/hardening/tasks/main.yml

@@ -1,42 +1,44 @@
 ---
 
-- name: include SELinux package tasks for EL (CentOS/RHEL)
-  include_tasks: centos-selinux.yml
+- name: Include SELinux package tasks for EL (CentOS/RHEL)
+  ansible.builtin.include_tasks: centos-selinux.yml
   tags: selinux
   when: (ansible_distribution in ["CentOS" , "Red Hat Enterprise Linux", "RedHat"])
 
-- name: include SELinux package tasks for Fedora (non-atomic)
-  include_tasks: fedora-selinux.yml
+- name: Include SELinux package tasks for Fedora (non-atomic)
+  ansible.builtin.include_tasks: fedora-selinux.yml
   tags: selinux
-  when: (ansible_distribution in ["Fedora"] and not is_atomic)
+  when: (ansible_distribution in ["Fedora"] and not ansible_local.os.is_atomic)
 
-# likely to break on non-RHEL/derivatives, could use improvement.
-- name: ensure firewalld is installed
+- name: Ensure firewalld is installed
   become: true
-  package:
+  when: ansible_os_family in ['RedHat']  # Ubuntu has shown packaging issues with this and *tables in particular
+  ansible.builtin.package:
     name: firewalld
     state: present
 
-- name: enable firewalld
+- name: Enable firewalld
   become: true
-  service:
+  when: ansible_os_family in ['RedHat']
+  ansible.builtin.service:
     name: firewalld
     state: started
     enabled: true
 
-- name: harden sshd
+- name: Harden sshd
   tags: harden_sshd
   become: true
   block:
     - name: "SSH: disable password auth"
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: "^PasswordAuthentication"
         line: "PasswordAuthentication no"
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
+
     - name: "SSH: config custom port"
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^Port '
         line: "Port {{ hardened_ssh_port }}"
@@ -44,24 +46,26 @@
         validate: '/usr/sbin/sshd -t -f %s'
       when: (hardened_ssh_port is defined)
       notify: restart sshd
-    - name: "only allow root logins with keys"
-      lineinfile:
+
+    - name: "Only allow root logins with keys"
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^PermitRootLogin '
         line: 'PermitRootLogin prohibit-password'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
-    - name: "disallow keyboard interactive auth to address some PAM edge cases"
-      lineinfile:
+
+    - name: "Disallow keyboard interactive auth to address some PAM edge cases"
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^KbdInteractiveAuthentication '
         line: 'KbdInteractiveAuthentication no'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
 
-- name: "permit custom SSH port ({{ hardened_ssh_port }})"
+- name: "SELinux grant for custom SSH port ({{ hardened_ssh_port }})"
   become: true
-  seport:
+  community.general.seport:
     ports: "{{ hardened_ssh_port }}"
     proto: tcp
     setype: ssh_port_t
@@ -72,12 +76,13 @@
     - ansible_selinux.status == 'enabled'
   tags: selinux
 
-# also likely to break on non-RHEL/derivatives, could use improvement too.
-- name: "firewalld: grant access to custom SSH port"
+- name: "Firewalld: grant access to custom SSH port"
   become: true
-  firewalld:
+  ansible.posix.firewalld:
     port: "{{ hardened_ssh_port }}/tcp"
     permanent: true
     immediate: true
     state: enabled
-  when: (hardened_ssh_port is defined)
+  when:
+    - hardened_ssh_port is defined
+    - ansible_os_family in ['RedHat']