roles/hardening/tasks/main.yml

@@ -1,44 +1,42 @@
 ---
 
-- name: Include SELinux package tasks for EL (CentOS/RHEL)
+- name: include SELinux package tasks for EL (CentOS/RHEL)
-  ansible.builtin.include_tasks: centos-selinux.yml
+  include_tasks: centos-selinux.yml
   tags: selinux
   when: (ansible_distribution in ["CentOS" , "Red Hat Enterprise Linux", "RedHat"])
 
-- name: Include SELinux package tasks for Fedora (non-atomic)
+- name: include SELinux package tasks for Fedora (non-atomic)
-  ansible.builtin.include_tasks: fedora-selinux.yml
+  include_tasks: fedora-selinux.yml
   tags: selinux
-  when: (ansible_distribution in ["Fedora"] and not ansible_local.os.is_atomic)
+  when: (ansible_distribution in ["Fedora"] and not is_atomic)
 
-- name: Ensure firewalld is installed
+# likely to break on non-RHEL/derivatives, could use improvement.
+- name: ensure firewalld is installed
   become: true
-  when: ansible_os_family in ['RedHat']  # Ubuntu has shown packaging issues with this and *tables in particular
+  package:
-  ansible.builtin.package:
     name: firewalld
     state: present
 
-- name: Enable firewalld
+- name: enable firewalld
   become: true
-  when: ansible_os_family in ['RedHat']
+  service:
-  ansible.builtin.service:
     name: firewalld
     state: started
     enabled: true
 
-- name: Harden sshd
+- name: harden sshd
   tags: harden_sshd
   become: true
   block:
     - name: "SSH: disable password auth"
-      ansible.builtin.lineinfile:
+      lineinfile:
         path: /etc/ssh/sshd_config
         regexp: "^PasswordAuthentication"
         line: "PasswordAuthentication no"
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
-
     - name: "SSH: config custom port"
-      ansible.builtin.lineinfile:
+      lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^Port '
         line: "Port {{ hardened_ssh_port }}"
@@ -46,26 +44,24 @@
         validate: '/usr/sbin/sshd -t -f %s'
       when: (hardened_ssh_port is defined)
       notify: restart sshd
-
+    - name: "only allow root logins with keys"
-    - name: "Only allow root logins with keys"
+      lineinfile:
-      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^PermitRootLogin '
         line: 'PermitRootLogin prohibit-password'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
-
+    - name: "disallow keyboard interactive auth to address some PAM edge cases"
-    - name: "Disallow keyboard interactive auth to address some PAM edge cases"
+      lineinfile:
-      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^KbdInteractiveAuthentication '
         line: 'KbdInteractiveAuthentication no'
         validate: '/usr/sbin/sshd -t -f %s'
       notify: restart sshd
 
-- name: "SELinux grant for custom SSH port ({{ hardened_ssh_port }})"
+- name: "permit custom SSH port ({{ hardened_ssh_port }})"
   become: true
-  community.general.seport:
+  seport:
     ports: "{{ hardened_ssh_port }}"
     proto: tcp
     setype: ssh_port_t
@@ -76,13 +72,12 @@
     - ansible_selinux.status == 'enabled'
   tags: selinux
 
-- name: "Firewalld: grant access to custom SSH port"
+# also likely to break on non-RHEL/derivatives, could use improvement too.
+- name: "firewalld: grant access to custom SSH port"
   become: true
-  ansible.posix.firewalld:
+  firewalld:
     port: "{{ hardened_ssh_port }}/tcp"
     permanent: true
     immediate: true
     state: enabled
-  when:
+  when: (hardened_ssh_port is defined)
-    - hardened_ssh_port is defined
-    - ansible_os_family in ['RedHat']

roles/update-packages/tasks/main.yml

@@ -1,34 +1,34 @@
 ---
 - block:
 
-    - name: Update packages (Fedora Atomic)
+    - name: update packages (Fedora Atomic)
-      community.general.atomic_host:
+      atomic_host:
         revision: latest
-      when: ansible_distribution == 'Fedora' and ansible_local.os.is_atomic
+      when: ansible_distribution == 'Fedora' and is_atomic
       register: atomic_host_upgraded
 
-    - name: Refresh and update packages (DNF driven distros)
+    - name: refresh and update packages (Fedora)
-      ansible.builtin.dnf:
+      dnf:
         name: "*"
         state: latest
-        update_cache: true
+        update_cache: yes
-      when: ansible_distribution in ['CentOS', 'Fedora', 'Red Hat Enterprise Linux', 'RedHat'] and not ansible_local.os.is_atomic
+      when: ansible_distribution == 'Fedora' and not is_atomic
       register: fedora_upgraded
 
-    - name: Update packages (generic - non-atomic/dnf)
+    - name: update packages (generic - non-atomic/dnf)
-      ansible.builtin.package:
+      package:
         name: '*'
         state: latest
-      when: ansible_distribution in ["Debian", "Ubuntu"]
+      when: ansible_distribution in ["CentOS", "Red Hat Enterprise Linux", "RedHat", "Debian", "Ubuntu"] and not is_atomic
       register: host_upgraded
 
-    - name: Reboot updated hosts
+    - name: reboot updated hosts
-      ansible.builtin.shell: nohup bash -c "sleep 2 && shutdown -r now" &
+      shell: nohup bash -c "sleep 2 && shutdown -r now" &
       register: host_reset
       when: (atomic_host_upgraded is changed) or (host_upgraded is changed) or (fedora_upgraded is changed)
 
-    - name: Wait for rebooted host to return
+    - name: wait for rebooted host to return
-      ansible.builtin.wait_for_connection:
+      wait_for_connection:
         timeout: 300
         delay: 20
       when: host_reset is changed