README.md

@@ -9,22 +9,6 @@ Most of the roles are adaptable for use with systems beyond ArchLinux, requiring
 - RHEL Systems are not currently supported due to restricted access to their repositories.
   A workaround could involve using an ISO as a local repository or setting up a proxy repository to facilitate access.
 
-# Supported Distributions
-
-This playbook supports multiple Linux distributions with specific versions tailored to each. Below is a list of supported distributions:
-
-| `os`       | Distribution                       |
-|------------|------------------------------------|
-| archlinux  | ArchLinux (Latest rolling release) |
-| almalinux  | AlmaLinux 8.x, 9.x                 |
-| debian11   | Debian 11 (Bullseye)               |
-| debian12   | Debian 12 (Bookworm)               |
-| fedora     | Fedora 40                          |
-| rocky      | Rocky Linux 9.x                    |
-| ubuntu     | Ubuntu 23.10 (Mantic Minotaur)     |
-| ubuntu-lts | Ubuntu 22.04 LTS (Jammy Jellyfish) |
-
-
 # Documentation
 
 ## Table of Contents

roles/bootstrap/vars/packages.yml

@@ -1,7 +1,6 @@
 almalinux:
   - bind-utils
   - cloud-init
-  - dbus-daemon
   - dhcp-client
   - efibootmgr
   - glibc-langpack-de
@@ -14,7 +13,6 @@ almalinux:
   - nfs-utils
   - nfsv4-client-utils
   - open-vm-tools
-  - ppp
   - shim
   - telnet
   - vim
@@ -32,7 +30,6 @@ archlinux:
   - fish
   - grub
   - htop
-  - libpwquality
   - linux
   - logrotate
   - lrzsz
@@ -44,7 +41,6 @@ archlinux:
   - nfs-utils
   - openssh
   - open-vm-tools
-  - ppp
   - prometheus-node-exporter
   - python-psycopg2
   - qemu-guest-agent
@@ -144,22 +140,18 @@ fedora:
   - bind-utils
   - btrfs-progs
   - cloud-init
-  - cronie
   - dhcp-client
   - efibootmgr
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
   - grub2-efi
-  - logrotate
   - lrzsz
   - lvm2
   - nc
   - nfs-utils
   - nfsv4-client-utils
   - open-vm-tools
-  - polkit
-  - ppp
   - shim
   - telnet
   - vim-default-editor
@@ -197,7 +189,6 @@ rhel9:
 rocky:
   - bind-utils
   - cloud-init
-  - dbus-daemon
   - dhcp-client
   - efibootmgr
   - glibc-langpack-de
@@ -210,7 +201,6 @@ rocky:
   - nfs-utils
   - nfsv4-client-utils
   - open-vm-tools
-  - ppp
   - shim
   - telnet
   - util-linux-core

roles/cis/tasks/main.yml

@@ -65,7 +65,7 @@
     #     - { regexp: '^PASS_MIN_DAYS.*', replace: 'PASS_MIN_DAYS 7' }
     #     - { regexp: '^UMASK.*', replace: 'UMASK           027' }
 
-    - name: Ensure files exist
+    - name: Create allow files
       file:
         path: "{{ item }}"
         state: touch
@@ -73,8 +73,6 @@
       loop:
         - /mnt/etc/at.allow
         - /mnt/etc/cron.allow
-        - /mnt/etc/hosts.allow
-        - /mnt/etc/hosts.deny
 
     - name: Add Security related lines into config files
       lineinfile:
@@ -87,14 +85,14 @@
         - { path: '/mnt/etc/security/pwquality.conf', content: 'ucredit = -1' }
         - { path: '/mnt/etc/security/pwquality.conf', content: 'ocredit = -1' }
         - { path: '/mnt/etc/security/pwquality.conf', content: 'lcredit = -1' }
-        - { path: '/mnt/etc/{{ "bashrc" if os in ["almalinux", "fedora", "rocky"] else "bash.bashrc" }}', content: 'umask 077' }
-        - { path: '/mnt/etc/{{ "bashrc" if os in ["almalinux", "fedora", "rocky"] else "bash.bashrc" }}', content: 'export TMOUT=3000' }
-        - { path: '/mnt/{{ "usr/lib/systemd/journald.conf" if os == "fedora" else "etc/systemd/journald.conf" }}', content: 'Storage=persistent' }
+        - { path: '/mnt/etc/bash.bashrc', content: 'umask 077' }
+        - { path: '/mnt/etc/bash.bashrc', content: 'export TMOUT=3000' }
+        - { path: '/mnt/etc/systemd/journald.conf', content: 'Storage=persistent' }
         - { path: '/mnt/etc/sudoers', content: 'Defaults        logfile="/var/log/sudo.log"' }
         - { path: '/mnt/etc/pam.d/su', content: 'auth required pam_wheel.so' }
-        - { path: '/mnt/etc/{{ "pam.d/common-auth" if os in ["debian11", "debian12", "ubuntu", "ubuntu-lts"] else "authselect/system-auth" if os == "fedora" else "pam.d/system-auth" }}', content: 'auth required pam_faillock.so onerr=fail audit silent deny=5 unlock_time=900' }
-        - { path: '/mnt/etc/{{ "pam.d/common-account" if os in ["debian11", "debian12", "ubuntu", "ubuntu-lts"] else "authselect/system-auth" if os == "fedora" else "pam.d/system-auth" }}', content: 'account required pam_faillock.so' }
-        - { path: '/mnt/etc/pam.d/{{ "common-password" if os in ["debian11", "debian12", "ubuntu", "ubuntu-lts"] else "passwd" }}', content: 'password [success=1 default=ignore] pam_unix.so obscure sha512 remember=5' }
+        - { path: '/mnt/etc/pam.d/common-auth', content: 'auth required pam_faillock.so onerr=fail audit silent deny=5 unlock_time=900' }
+        - { path: '/mnt/etc/pam.d/common-account', content: 'account required pam_faillock.so' }
+        - { path: '/mnt/etc/pam.d/common-password', content: 'password [success=1 default=ignore] pam_unix.so obscure sha512 remember=5' }
         - { path: '/mnt/etc/hosts.deny', content: 'ALL: ALL' }
         - { path: '/mnt/etc/hosts.allow', content: 'sshd: ALL' }
 
@@ -114,8 +112,12 @@
         - { path: '/mnt/etc/crontab', mode: '0600' }
         - { path: '/mnt/etc/logrotate.conf', mode: '0644' }
         - { path: '/mnt/usr/sbin/pppd', mode: '754' }
-        - { path: '/mnt/usr/bin/{{ "fusermount3" if os in ["archlinux", "debian12", "fedora"] else "fusermount" }}', mode: '755' }
+        - { path: '/mnt/usr/lib/dbus-1.0/dbus-daemon-launch-helper', mode: '754' }
+        - { path: '/mnt/usr/libexec/polkit-agent-helper-1', mode: '755' }
+        - { path: '/mnt/usr/bin/{{ "fusermount" if os == "debian11" else "fusermount3" }}', mode: '755' }
         - { path: '/mnt/usr/bin/{{ "write.ul" if os == "debian11" else "write" }}', mode: '755' }
+        - { path: '/mnt/usr/lib/x86_64-linux-gnu/utempter/utempter', mode: '755' }
+        - { path: '/mnt/home/svcansible', mode: '750' }
 
     - name: Adjust SSHD config
       lineinfile:

roles/configuration/tasks/main.yml

@@ -97,6 +97,7 @@
           command: arch-chroot /mnt {% if os | lower == "archlinux" %}/usr/sbin/mkinitcpio -P{% elif os | lower not in ["debian11", "debian12", "ubuntu", "ubuntu-lts", "archlinux"] %}/usr/bin/dracut --regenerate-all --force{% else %}echo "Skipping initramfs regeneration"{% endif %}
 
     - name: Extra Configuration
+      when: os | lower != "archlinux"
       block:
         - name: Append lines to vimrc
           ignore_errors: true
@@ -112,7 +113,6 @@
             - "set mouse=a"
 
         - name: Copy FirstRun Script
-          when: os | lower != "archlinux"
           template:
             src: firstrun.sh.j2
             dest: /mnt/root/firstrun.sh