Feb updates to main release by uk-bolly · Pull Request #155 · ansible-lockdown/UBUNTU24-CIS

uk-bolly · 2026-02-24T16:05:36Z

Please ensure that you have understood contributing guide
Ensure all commits are signed-by and gpg signed

Overall Review of Changes:
.gitignore update
lint and variable naming

[2.1.2] fix when condition for avahi #141 - 2.1.2 damon name
[5.1.x] fix ssh keys permissions #142 - ssh keys typo fix
[5.3.2.x] remove executable flag on config files for owner #143 - remove extended permissions
[5.3.3.1.x] set permissions on /etc/security/faillock.conf #144 - tighten permissions on faillock
[5.3.3.1.3] fix regexp as in ubuntu 24.04 cis #145 - 5.3.3.1.3 aligned command with CIS benchmark
[5.3.3.3.x] sync audit regexp with cis #146 - 5.3.3.3.x aligned
[5.3.2, 5.3.3.3.1, 5.3.3.3.x] fix pam_pwhistory file generation #147 - 5.3.2 and 5.3.3.3.x pwhistory generation tidy up
[6.1.1.1.3] make journald params more clear in defaults #149 - tidy up journald params
[6.2.4.9] remove group permission setting in 6.2.4.9 #150 - 6.2.4.9 remove group from task
[2.4.1]/feature add control variable for cron allowed users #153 - 2.4.1.5 ability to add cron users
Repo Checker QA fixes
Grammar fixes: removed multiple consecutive spaces across defaults, tasks, and templates
Grammar fixes: corrected repeated words ('is is', 'the the', 'of of', 'can must')
Grammar fixes: fixed subject-verb disagreements in comments
Added missing variable ubtu24cis_priv_command_excluded_mounts
Added missing rule definition ubtu24cis_rule_4_4_1_4
Updated audit URL reference from RHEL8 to UBUNTU24
workflow updates
company name alignments
date updates
lint improvements
thanks to @bykvaadm
- fix 1.1.2.x audit message #136
- fix avahi package name #138
- 1.1.20 change xorg-x11-server-common to xserver-common #139
fix: 🐛 handle 'all' in outbound ports loop in rule rule_4.1.5 and apt/dpkg lock #137 thanks to @tmeckel
5.4.1.1/2/3 updated logic for ansible user based on Fixing issue 84 #127 @rronneburger
5.4.2.7 added create_home false thanks to @seven-beep
5.4.3.2 improvement thanks tio @stelucz
profile template now uses bash_umask variable
audit template var updates improved logic
7.2.7 fixed typo in warning
improved comments and description in defaults/main.yml

How has this been tested?:
Subscribers, devel and pipelines

Multiple users have /nonexistent as homedir by Debian packaging guideline The task "5.4.2.7 | PATCH | Ensure system accounts do not have a valid login shell" is creating the folder because ansible.builtin.user default to create the missing homedir, which is unexpected, as /nonexitent is not meant to be created. This commit avoids this unexpected behavior. Signed-off-by: seven beep <ebn@entreparentheses.xyz>

updates: - [github.com/ansible-community/ansible-lint: v25.12.2 → v26.1.1](ansible/ansible-lint@v25.12.2...v26.1.1) - [github.com/adrienverge/yamllint.git: v1.37.1 → v1.38.0](https://github.com/adrienverge/yamllint.git/compare/v1.37.1...v1.38.0)

…nfig [pre-commit.ci] pre-commit autoupdate

fix: do not create /nonexistent homedirs

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Jan26 updates

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

fix 1.1.2.x audit message

fix avahi package name

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

1.1.20 change xorg-x11-server-common to xserver-common

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

Signed-off-by: Henry Paulissen <henry@mixict.nl>

[2.1.2] fix when condition for avahi

[5.1.x] fix ssh keys permissions

[5.3.2.x] remove executable flag on config files for owner

[6.2.4.9] remove group permission setting in 6.2.4.9

[6.1.1.1.3] make journald params more clear in defaults

[5.3.3.3.x] sync audit regexp with cis

[5.3.3.1.3] fix regexp as in ubuntu 24.04 cis

[defaults] remove unused variable ubtu24cis_set_grub_user_pass

[4.2.5] Fix loop if allowed_out_ports in all

[5.3.2, 5.3.3.3.1, 5.3.3.3.x] fix pam_pwhistory file generation

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Feb26 updates

Signed-off-by: uk-bolly <69214557+uk-bolly@users.noreply.github.com>

[2.4.1]/feature add control variable for cron allowed users

frederickw082922

Great work! Thank you @uk-bolly

seven-beep and others added 30 commits January 16, 2026 15:43

Merge pull request #132 from ansible-lockdown/pre-commit-ci-update-co…

f394988

…nfig [pre-commit.ci] pre-commit autoupdate

Merge pull request #133 from seven-beep/nonexistent_homedirs

11a5255

fix: do not create /nonexistent homedirs

removed legacy setting

d057f6b

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated for #129 thanks to @stelucz

b3f5518

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

#92 readdressed

c6f1686

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Addressed PR #127

2e89cc0

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

979bfec

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

ddae237

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #134 from ansible-lockdown/Jan26_updates

609dca5

Jan26 updates

fix 1.1.2.x audit message

ef96d3b

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

fix avahi package name

2998e7c

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

Merge pull request #136 from bykvaadm/devel

e28b0fe

fix 1.1.2.x audit message

Merge pull request #138 from bykvaadm/fix_2.1.2

fa5c8ea

fix avahi package name

change xorg-x11-server-common to xserver-common

2d154d5

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

Merge pull request #139 from bykvaadm/fix_2.1.20

209737b

1.1.20 change xorg-x11-server-common to xserver-common

fix when condition for avahi 2.1.2

83f8189

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

fix ssh keys permissions

3092640

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

5.3.2.x remove executable flag on config files for owner

9acb9cb

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[5.3.3.1.3] fix regexp as in ubuntu 24.04 cis

8fb0363

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[5.3.3.3.x] sync audit regexp with cis

28509b7

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[5.3.2, 5.3.3.3.x] fix pam_pwhistory file generation

caf8d38

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[6.1.1.1.3] make journald params more clear in defaults

0200149

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[6.2.4.9] remove group permission setting in 6.2.4.9

dd9c97e

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[defaults] remove unused variable ubtu24cis_set_grub_user_pass

92a6ea4

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

[4.2.5] Fix loop if allowed_out_ports in all

2897cd6

Signed-off-by: Henry Paulissen <henry@mixict.nl>

Merge pull request #141 from bykvaadm/fix_2.1.2_when

f2e0717

[2.1.2] fix when condition for avahi

Merge pull request #142 from bykvaadm/fix_5.1.x

98c0681

[5.1.x] fix ssh keys permissions

Merge pull request #143 from bykvaadm/fix_5.3.2.x

8df64e5

[5.3.2.x] remove executable flag on config files for owner

uk-bolly and others added 26 commits February 23, 2026 13:35

Merge pull request #150 from bykvaadm/fix_6.2.4.9

56c7168

[6.2.4.9] remove group permission setting in 6.2.4.9

Merge pull request #149 from bykvaadm/fix_6.1.1.3

488d642

[6.1.1.1.3] make journald params more clear in defaults

Merge pull request #146 from bykvaadm/fix_5.3.3.3.x

5cb2c3a

[5.3.3.3.x] sync audit regexp with cis

Merge pull request #145 from bykvaadm/fix_5.3.3.1.3_audit_regexp

6587189

[5.3.3.1.3] fix regexp as in ubuntu 24.04 cis

Merge pull request #151 from bykvaadm/default_cleanup

465c765

[defaults] remove unused variable ubtu24cis_set_grub_user_pass

Merge pull request #152 from hp197/fix_ubtu24cis_ufw_allow_out_ports

b1374fb

[4.2.5] Fix loop if allowed_out_ports in all

Merge pull request #147 from bykvaadm/fix_pam_pwhistory

7a94d6d

[5.3.2, 5.3.3.3.1, 5.3.3.3.x] fix pam_pwhistory file generation

updated

75062e7

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

audit alignment var naming

96f51eb

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

1.1.1.6 updated typo for overlayfs

1c535ac

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

lint and apt timeout added

30f2299

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

improved

bec2763

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

apt purge and timeout added - lint

e893343

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

var naming

e7ae219

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

lint

42b71ef

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

apt lockout added

65f1ddd

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

lint and improvements

5f641b5

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Company name update

77908d1

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Tidy up vars and limt

8bcefbe

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

f0008e7

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

[2.4.1]/feature add control variable for cron allowed users

6d64ec7

Signed-off-by: Kondratev Alexander <info@bykvaadm.ru>

fix task error

968b742

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Updated

cfe3a16

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #154 from ansible-lockdown/feb26_updates

dafeabf

Feb26 updates

Merge branch 'devel' into 2.4.1_feature

6a7e0ba

Signed-off-by: uk-bolly <69214557+uk-bolly@users.noreply.github.com>

Merge pull request #153 from bykvaadm/2.4.1_feature

40f15e6

[2.4.1]/feature add control variable for cron allowed users

uk-bolly requested a review from frederickw082922 February 24, 2026 16:05

frederickw082922 approved these changes Feb 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Feb updates to main release#155

Feb updates to main release#155
uk-bolly wants to merge 56 commits intomainfrom
devel

uk-bolly commented Feb 24, 2026 •

edited

Loading

Uh oh!

frederickw082922 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

Conversation

uk-bolly commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

frederickw082922 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

uk-bolly commented Feb 24, 2026 •

edited

Loading