Playbook won't run for hardening

[Mike-Zelixon]

Hi guys,
I'm an ansible n00b and the os hardening isn't working for me.

I wrote a simple playbook like in the default

- hosts: localhost
  become: true 
  ignore_errors: yes
  ignore_unreachable: yes 
 
  collections:
    - devsec.hardening
  roles:
    - os_hardening

and added a hosts file with localhost as host.

I run ansible-playbook -i host play.yml and this is what I get

PLAY [localhost] **********************************************************************************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************************************************
fatal: [localhost]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: connect to host localhost port 22: Connection refused", "skip_reason": "Host localhost is unreachable", "unreachable": true}

TASK [os_hardening : include_tasks] ***************************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"reason": "couldn't resolve module/action 'pam_limits'. This often indicates a misspelling, missing collection, or incorrect module path.\n\nThe error appears to be in '/etc/ansible/roles/os_hardening/tasks/limits.yml': line 11, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b\n    ^ here\n"}

PLAY RECAP ****************************************************************************************************************************************************************************
localhost                  : ok=0    changed=0    unreachable=1    failed=1    skipped=1    rescued=0    ignored=0   

if anyone can help me i would greatly appreciate it !!!!!!

[rndmh3ro]

The error means that ansible cannot connect to your local server via ssh. This has nathing to do with the collection.

Try this:

- hosts: localhost
  connection: local
  collections:
    - devsec.hardening
  roles:
    - os_hardening

[Mike-Zelixon]

Thanks!!! But what about the 2nd error?
With 'pam_limits'
I get the same error with the new YML and then it stops.

[rndmh3ro]

If you fill out the bug-template that we provide, I can try to help you. What Ansible version do you use. How did you install the collection? What other collections are installed?

[Mike-Zelixon]

Bug template? Didn't see one.
I use ansible 2.10... I installed the collection via the github repo and via galaxy as well I believe.
Really appreciate the fast answers.

[rndmh3ro]

Do you have the community.general collection installed?
https://docs.ansible.com/ansible/latest/collections/community/general/pam_limits_module.html

This plugin is part of the community.general collection (version 3.3.0).

To install it use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.pam_limits.

[Mike-Zelixon]

Ok... I installed it... put it into play.yml.... and now I'm getting this

ERROR! 'community.general.pam_limits' is not a valid attribute for a Play

The error appears to be in '/etc/ansible/roles/os_hardening/defaults/play.yml': line 1, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

[rndmh3ro]

Your indentation is probably wrong. Please show the code you used.

[Mike-Zelixon]

You told me to include in the playbook no?

I tried this

- hosts: localhost
  connection: local
  ignore_errors: yes   
 
  collections:
    - devsec.hardening
  roles:
    - os_hardening


- name: Mike 
  community.general.pam_limits:
    domain: localhost

and this . nothing works.

- hosts: localhost
  connection: local
  ignore_errors: yes   
 
  collections:
    - devsec.hardening
  roles:
    - os_hardening
 
  community.general.pam_limits:
    domain: localhost

[rndmh3ro]

You probably should read some introductional tutorials on Ansible to get the basics before trying to use mroe complicated collections.

Use this:

- hosts: localhost
  connection: local
 
  collections:
    - devsec.hardening
  roles:
    - os_hardening
  tasks:
    - name: Mike 
      community.general.pam_limits:
        domain: localhost

[Mike-Zelixon]

I don't understand...
I used exactly what you wrote just now....
And I still get an error...

ERROR! couldn't resolve module/action 'community.general.pam_limits'. This often indicates a misspelling, missing collection, or incorrect module path.

The error appears to be in '/etc/ansible/roles/os_hardening/defaults/play.yml': line 9, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

I installed the module with ansible galaxy and I'm still getting this error.

At this point I'm almost ready to give up and use another hardening script....

[rndmh3ro]

I used exactly what you wrote just now....

No, you didn't, the code you showed and the code I showed are different.

The error appears to be in '/etc/ansible/roles/os_hardening/defaults/play.yml': line 9, column 7, but may

This seems to me that Ansible doesn't use the collection but instead a role.

As this is not a support forum and your issue not a bug, please read up on the basic Ansible concepts.

[Mike-Zelixon]

This is what I used (exactly what you told me to do)

- hosts: localhost
  connection: local
 
  collections:
    - devsec.hardening
  roles:
    - os_hardening
  tasks:
    - name: Mike 
      community.general.pam_limits:
        domain: localhost

this is the error i get

ERROR! couldn't resolve module/action 'community.general.pam_limits'. This often indicates a misspelling, missing collection, or incorrect module path.

am i missing something here ???

i'm sorry if i'm being a burden I really am

[schurzi]

Do you have the community.general collection installed?
https://docs.ansible.com/ansible/latest/collections/community/general/pam_limits_module.html

This plugin is part of the community.general collection (version 3.3.0).

To install it use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.pam_limits.

I'm thinking, maybe this error is from an older version of community.general collection. @Mike-Zelixon could you plase run ansible-galaxy collection list on your ansible host and paste the output here?

currently we a re declaring a dependency on community.general in version 1.0.0, this seems wrong and maybe the cause for this problem.

ansible-collection-hardening/galaxy.yml

Line 23 in 2c5cf45

community.general: '>=1.0.0'

[rndmh3ro]

I jsut checked, pam_limits was already in community.general 1.0.0.

@Mike-Zelixon, if you still have problems, please open a new issue. Thanks!