Merge pull request #908 from ctorrisi/manage-pam-packages-conditionals-suse-usbguard

chore: add manage_packages toggle, add manage_password toggle, …

Author: konstruktoid

README.md

@@ -314,6 +314,7 @@ journald_storage: persistent
 journald_permissions: "2640"
 journald_group: "systemd-journal"
 journald_user: "root"
+journald_system_max_use: ""
 ```
 
 ### ./defaults/main/kernel.yml
@@ -463,6 +464,7 @@ apt_hardening_options:
 ### ./defaults/main/packages.yml
 
 ```yaml
+manage_packages: true
 system_upgrade: true
 
 packages_blocklist:
@@ -542,6 +544,7 @@ packages_ubuntu:
 ### ./defaults/main/password.yml
 
 ```yaml
+manage_password: true
 manage_pam: true
 manage_faillock: true
 manage_pwquality: true

defaults/main/journal.yml

@@ -10,3 +10,4 @@ journald_storage: persistent
 journald_permissions: "2640"
 journald_group: "systemd-journal"
 journald_user: "root"
+journald_system_max_use: ""

defaults/main/packages.yml

@@ -1,4 +1,5 @@
 ---
+manage_packages: true
 system_upgrade: true
 
 packages_blocklist:

defaults/main/password.yml

@@ -1,4 +1,5 @@
 ---
+manage_password: true
 manage_pam: true
 manage_faillock: true
 manage_pwquality: true

tasks/facts.yml

@@ -66,7 +66,7 @@
       ansible.builtin.set_fact:
         pam_version: "{{ ansible_facts.packages['pam'][0].version }}"
       when:
-        - ansible_os_family == "RedHat"
+        - ansible_os_family in ["RedHat", "Suse"]
         - "'pam' in ansible_facts.packages"
 
 - name: Set hashing algorithm for password (yescrypt|sha512)

tasks/main.yml

@@ -185,6 +185,8 @@
 - name: Configure needrestart, install and remove various packages
   ansible.builtin.import_tasks:
     file: packages.yml
+  when:
+    - manage_packages
   tags:
     - package_installation
 
@@ -199,6 +201,8 @@
 - name: Configure PAM
   ansible.builtin.import_tasks:
     file: password.yml
+  when:
+    - manage_password
   tags:
     - cracklib
     - crypto_policy

tasks/usbguard.yml

@@ -25,6 +25,13 @@
       when:
         - ansible_os_family == "RedHat"
 
+    - name: Suse family USBGuard package installation
+      community.general.zypper:
+        name: usbguard
+        state: present
+      when:
+        - ansible_os_family == "Suse"
+
     - name: Configure RuleFile
       ansible.builtin.lineinfile:
         regexp: (^|^#)RuleFile

templates/etc/systemd/journald.conf.j2

@@ -5,3 +5,4 @@
 Compress={{ 'yes' if journald_compress else 'no' }}
 ForwardToSyslog={{ 'yes' if journald_forwardtosyslog else 'no' }}
 Storage={{ journald_storage }}
+{{ 'SystemMaxUse=' ~ journald_system_max_use if journald_system_max_use else '#SystemMaxUse=' }}