From 14a3745aa4fd77c119906c2998d894fe695f1010 Mon Sep 17 00:00:00 2001 From: Josh Lay Date: Sun, 27 Jul 2025 12:57:13 -0500 Subject: [PATCH 1/2] hardening: lint --- roles/hardening/tasks/main.yml | 51 +++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/roles/hardening/tasks/main.yml b/roles/hardening/tasks/main.yml index 60ccc96..0798826 100644 --- a/roles/hardening/tasks/main.yml +++ b/roles/hardening/tasks/main.yml @@ -1,42 +1,44 @@ --- -- name: include SELinux package tasks for EL (CentOS/RHEL) - include_tasks: centos-selinux.yml +- name: Include SELinux package tasks for EL (CentOS/RHEL) + ansible.builtin.include_tasks: centos-selinux.yml tags: selinux when: (ansible_distribution in ["CentOS" , "Red Hat Enterprise Linux", "RedHat"]) -- name: include SELinux package tasks for Fedora (non-atomic) - include_tasks: fedora-selinux.yml +- name: Include SELinux package tasks for Fedora (non-atomic) + ansible.builtin.include_tasks: fedora-selinux.yml tags: selinux - when: (ansible_distribution in ["Fedora"] and not is_atomic) + when: (ansible_distribution in ["Fedora"] and not ansible_local.os.is_atomic) -# likely to break on non-RHEL/derivatives, could use improvement. -- name: ensure firewalld is installed +- name: Ensure firewalld is installed become: true - package: + when: ansible_os_family in ['RedHat'] # Ubuntu has shown packaging issues with this and *tables in particular + ansible.builtin.package: name: firewalld state: present -- name: enable firewalld +- name: Enable firewalld become: true - service: + when: ansible_os_family in ['RedHat'] + ansible.builtin.service: name: firewalld state: started enabled: true -- name: harden sshd +- name: Harden sshd tags: harden_sshd become: true block: - name: "SSH: disable password auth" - lineinfile: + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: "^PasswordAuthentication" line: "PasswordAuthentication no" validate: '/usr/sbin/sshd -t -f %s' notify: restart sshd + - name: "SSH: config custom port" - lineinfile: + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^Port ' line: "Port {{ hardened_ssh_port }}" @@ -44,24 +46,26 @@ validate: '/usr/sbin/sshd -t -f %s' when: (hardened_ssh_port is defined) notify: restart sshd - - name: "only allow root logins with keys" - lineinfile: + + - name: "Only allow root logins with keys" + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^PermitRootLogin ' line: 'PermitRootLogin prohibit-password' validate: '/usr/sbin/sshd -t -f %s' notify: restart sshd - - name: "disallow keyboard interactive auth to address some PAM edge cases" - lineinfile: + + - name: "Disallow keyboard interactive auth to address some PAM edge cases" + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^KbdInteractiveAuthentication ' line: 'KbdInteractiveAuthentication no' validate: '/usr/sbin/sshd -t -f %s' notify: restart sshd -- name: "permit custom SSH port ({{ hardened_ssh_port }})" +- name: "SELinux grant for custom SSH port ({{ hardened_ssh_port }})" become: true - seport: + community.general.seport: ports: "{{ hardened_ssh_port }}" proto: tcp setype: ssh_port_t @@ -72,12 +76,13 @@ - ansible_selinux.status == 'enabled' tags: selinux -# also likely to break on non-RHEL/derivatives, could use improvement too. -- name: "firewalld: grant access to custom SSH port" +- name: "Firewalld: grant access to custom SSH port" become: true - firewalld: + ansible.posix.firewalld: port: "{{ hardened_ssh_port }}/tcp" permanent: true immediate: true state: enabled - when: (hardened_ssh_port is defined) + when: + - hardened_ssh_port is defined + - ansible_os_family in ['RedHat'] From 0fc64bfd0a65bbcc92cfd6d35bd7a366c766004f Mon Sep 17 00:00:00 2001 From: Josh Lay Date: Sun, 27 Jul 2025 12:57:42 -0500 Subject: [PATCH 2/2] update-packages: lint --- roles/update-packages/tasks/main.yml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/roles/update-packages/tasks/main.yml b/roles/update-packages/tasks/main.yml index bc85cf2..7ecbe6f 100644 --- a/roles/update-packages/tasks/main.yml +++ b/roles/update-packages/tasks/main.yml @@ -1,34 +1,34 @@ --- - block: - - name: update packages (Fedora Atomic) - atomic_host: + - name: Update packages (Fedora Atomic) + community.general.atomic_host: revision: latest - when: ansible_distribution == 'Fedora' and is_atomic + when: ansible_distribution == 'Fedora' and ansible_local.os.is_atomic register: atomic_host_upgraded - - name: refresh and update packages (Fedora) - dnf: + - name: Refresh and update packages (DNF driven distros) + ansible.builtin.dnf: name: "*" state: latest - update_cache: yes - when: ansible_distribution == 'Fedora' and not is_atomic + update_cache: true + when: ansible_distribution in ['CentOS', 'Fedora', 'Red Hat Enterprise Linux', 'RedHat'] and not ansible_local.os.is_atomic register: fedora_upgraded - - name: update packages (generic - non-atomic/dnf) - package: + - name: Update packages (generic - non-atomic/dnf) + ansible.builtin.package: name: '*' state: latest - when: ansible_distribution in ["CentOS", "Red Hat Enterprise Linux", "RedHat", "Debian", "Ubuntu"] and not is_atomic + when: ansible_distribution in ["Debian", "Ubuntu"] register: host_upgraded - - name: reboot updated hosts - shell: nohup bash -c "sleep 2 && shutdown -r now" & + - name: Reboot updated hosts + ansible.builtin.shell: nohup bash -c "sleep 2 && shutdown -r now" & register: host_reset when: (atomic_host_upgraded is changed) or (host_upgraded is changed) or (fedora_upgraded is changed) - - name: wait for rebooted host to return - wait_for_connection: + - name: Wait for rebooted host to return + ansible.builtin.wait_for_connection: timeout: 300 delay: 20 when: host_reset is changed