Fix hardening overrides for SSH and LXD

Author: terion-labs

ansible/roles/hardening/defaults/main.yml

@@ -1,10 +1,13 @@
 sysctl_overwrite:
   net.ipv4.ip_forward: "1"
   net.ipv6.conf.all.forwarding: "1"
+  kernel.unprivileged_userns_clone: "1"
 
 os_firewall: false
 manage_ufw: false
-ssh_server_permitrootlogin: prohibit-password
+ssh_permit_root_login: "without-password"
+ssh_server_password_login: false
 ssh_use_pam: true
 ssh_client_alive_interval: 300
-ssh_client_alive_count_max: 2
+ssh_client_alive_count: 2
+ssh_max_auth_retries: 6

ansible/roles/hardening/tasks/main.yml

@@ -1,7 +1,18 @@
 - name: Apply dev-sec OS hardening
   ansible.builtin.include_role:
     name: devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite: "{{ sysctl_overwrite }}"
+    os_firewall: "{{ os_firewall }}"
+    manage_ufw: "{{ manage_ufw }}"
 
 - name: Apply dev-sec SSH hardening
   ansible.builtin.include_role:
     name: devsec.hardening.ssh_hardening
+  vars:
+    ssh_permit_root_login: "{{ ssh_permit_root_login }}"
+    ssh_server_password_login: "{{ ssh_server_password_login }}"
+    ssh_use_pam: "{{ ssh_use_pam }}"
+    ssh_client_alive_interval: "{{ ssh_client_alive_interval }}"
+    ssh_client_alive_count: "{{ ssh_client_alive_count }}"
+    ssh_max_auth_retries: "{{ ssh_max_auth_retries }}"