Ansible role for security hardening
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
OpenStack Proposal Bot f0c6c1d00f Updated from OpenStack Ansible Tests 1 week ago
defaults Chrony: new NTP server defaults 4 months ago
doc Merge "Update the HTTP links to HTTPS in developer-guide.rst." 3 weeks ago
files Add support for the openSUSE Leap distributions 1 year ago
handlers Always quote the filesystem permissions 1 year ago
library Verify password age limits [+Docs] 2 years ago
meta SUSE: Add support for openSUSE Leap 15 9 months ago
releasenotes Update master for stable/stein 1 month ago
tasks Fix conditional cast to bool 2 months ago
templates Switch to rtcsync for chrony 4 months ago
test_plugins Add equalto Jinja2 test for EL7 1 year ago
tests Add retries to package installations 11 months ago
vars Replace Fedora 26 with 27 1 year ago
zuul.d debian: drop stable job 1 month ago
.gitignore Updated from OpenStack Ansible Tests 7 months ago
.gitreview OpenDev Migration Patch 1 month ago
.zuul.yaml import zuul job settings from project-config 9 months ago
LICENSE Initial import of openstack-ansible-security role 3 years ago Add release note link in README 10 months ago
README.rst Add document information to readme 10 months ago
Vagrantfile Updated from OpenStack Ansible Tests 1 week ago
bindep.txt Updated from OpenStack Ansible Tests 1 week ago
manual-test.rc Use centralised test scripts 2 years ago Updated from OpenStack Ansible Tests 1 week ago
setup.cfg Change openstack-dev to openstack-discuss 5 months ago Updated from global requirements 2 years ago
tox.ini fix tox python3 overrides 6 months ago



The ansible-hardening role applies security hardening configurations from the Security Technical Implementation Guide (STIG) to systems running the following distributions:

  • CentOS 7
  • Debian Jessie
  • Fedora 27
  • openSUSE Leap 42.2 and 42.3
  • Red Hat Enterprise Linux 7
  • SUSE Linux Enterprise 12 (experimental)
  • Ubuntu 16.04

For more details, review the ansible-hardening documentation.

Release notes for the project can be found at:


This role can be used with or without OpenStack-Ansible. It requires Ansible 2.3 or later.

Role Variables

All of the variables for this role are in defaults/main.yml.


This role has no dependencies.

Example Playbook

Using the role is fairly straightforward:

- hosts: servers
     - ansible-hardening

Running with Vagrant

This role can be tested easily on multiple platforms using Vagrant.

The Vagrantfile supports testing on:

  • Ubuntu 16.04
  • CentOS 7

To test on all platforms:

vagrant destroy --force && vagrant up

To test on Ubuntu 14.04 only:

vagrant destroy ubuntu1404 --force && vagrant up ubuntu1404

To test on Ubuntu 16.04 only:

vagrant destroy ubuntu1604 --force && vagrant up ubuntu1604

To test on CentOS 7 only:

vagrant destroy centos7 --force && vagrant up centos7


Apache 2.0

Author Information

For more information, join #openstack-ansible on Freenode.