update-packages: lint

roles/hardening/tasks/main.yml

@@ -1,42 +1,44 @@
 ---
 
-- name: include SELinux package tasks for EL (CentOS/RHEL)
+- name: Include SELinux package tasks for EL (CentOS/RHEL)
-  include_tasks: centos-selinux.yml
+  ansible.builtin.include_tasks: centos-selinux.yml
   tags: selinux
   when: (ansible_distribution in ["CentOS" , "Red Hat Enterprise Linux", "RedHat"])
 
-- name: include SELinux package tasks for Fedora (non-atomic)
+- name: Include SELinux package tasks for Fedora (non-atomic)
-  include_tasks: fedora-selinux.yml
+  ansible.builtin.include_tasks: fedora-selinux.yml
   tags: selinux
-  when: (ansible_distribution in ["Fedora"] and not is_atomic)
+  when: (ansible_distribution in ["Fedora"] and not ansible_local.os.is_atomic)
 
-# likely to break on non-RHEL/derivatives, could use improvement.
+- name: Ensure firewalld is installed
-- name: ensure firewalld is installed
   become: true
-  package:
+  when: ansible_os_family in ['RedHat']  # Ubuntu has shown packaging issues with this and *tables in particular
+  ansible.builtin.package:
     name: firewalld
     state: present
 
-- name: enable firewalld
+- name: Enable firewalld
   become: true
-  service:
+  when: ansible_os_family in ['RedHat']
+  ansible.builtin.service:
     name: firewalld
     state: started
     enabled: true
 
-- name: harden sshd
+- name: Harden sshd
   tags: harden_sshd
   become: true
   block:
     - name: "SSH: disable password auth"
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: "^PasswordAuthentication"
         line: "PasswordAuthentication no"
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
+
     - name: "SSH: config custom port"
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^Port '
         line: "Port {{ hardened_ssh_port }}"
@@ -44,24 +46,26 @@
         validate: '/usr/sbin/sshd -t -f %s'
       when: (hardened_ssh_port is defined)
       notify: restart sshd
-    - name: "only allow root logins with keys"
+
-      lineinfile:
+    - name: "Only allow root logins with keys"
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^PermitRootLogin '
         line: 'PermitRootLogin prohibit-password'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
-    - name: "disallow keyboard interactive auth to address some PAM edge cases"
+
-      lineinfile:
+    - name: "Disallow keyboard interactive auth to address some PAM edge cases"
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^KbdInteractiveAuthentication '
         line: 'KbdInteractiveAuthentication no'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
 
-- name: "permit custom SSH port ({{ hardened_ssh_port }})"
+- name: "SELinux grant for custom SSH port ({{ hardened_ssh_port }})"
   become: true
-  seport:
+  community.general.seport:
     ports: "{{ hardened_ssh_port }}"
     proto: tcp
     setype: ssh_port_t
@@ -72,12 +76,13 @@
     - ansible_selinux.status == 'enabled'
   tags: selinux
 
-# also likely to break on non-RHEL/derivatives, could use improvement too.
+- name: "Firewalld: grant access to custom SSH port"
-- name: "firewalld: grant access to custom SSH port"
   become: true
-  firewalld:
+  ansible.posix.firewalld:
     port: "{{ hardened_ssh_port }}/tcp"
     permanent: true
     immediate: true
     state: enabled
-  when: (hardened_ssh_port is defined)
+  when:
+    - hardened_ssh_port is defined
+    - ansible_os_family in ['RedHat']

roles/update-packages/tasks/main.yml

@@ -1,34 +1,34 @@
 ---
 - block:
 
-    - name: update packages (Fedora Atomic)
+    - name: Update packages (Fedora Atomic)
-      atomic_host:
+      community.general.atomic_host:
         revision: latest
-      when: ansible_distribution == 'Fedora' and is_atomic
+      when: ansible_distribution == 'Fedora' and ansible_local.os.is_atomic
       register: atomic_host_upgraded
 
-    - name: refresh and update packages (Fedora)
+    - name: Refresh and update packages (DNF driven distros)
-      dnf:
+      ansible.builtin.dnf:
         name: "*"
         state: latest
-        update_cache: yes
+        update_cache: true
-      when: ansible_distribution == 'Fedora' and not is_atomic
+      when: ansible_distribution in ['CentOS', 'Fedora', 'Red Hat Enterprise Linux', 'RedHat'] and not ansible_local.os.is_atomic
       register: fedora_upgraded
 
-    - name: update packages (generic - non-atomic/dnf)
+    - name: Update packages (generic - non-atomic/dnf)
-      package:
+      ansible.builtin.package:
         name: '*'
         state: latest
-      when: ansible_distribution in ["CentOS", "Red Hat Enterprise Linux", "RedHat", "Debian", "Ubuntu"] and not is_atomic
+      when: ansible_distribution in ["Debian", "Ubuntu"]
       register: host_upgraded
 
-    - name: reboot updated hosts
+    - name: Reboot updated hosts
-      shell: nohup bash -c "sleep 2 && shutdown -r now" &
+      ansible.builtin.shell: nohup bash -c "sleep 2 && shutdown -r now" &
       register: host_reset
       when: (atomic_host_upgraded is changed) or (host_upgraded is changed) or (fedora_upgraded is changed)
 
-    - name: wait for rebooted host to return
+    - name: Wait for rebooted host to return
-      wait_for_connection:
+      ansible.builtin.wait_for_connection:
         timeout: 300
         delay: 20
       when: host_reset is changed