add support for Ubuntu 24.04 (#25)

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v8.2.0
+
+- **FEATURE**
+  - add support for Ubuntu 24.04
+
 ## v8.1.0
 
 - **OTHER**

README.md

@@ -24,6 +24,11 @@ See full  [CHANGELOG.md](https://github.com/githubixx/ansible-role-harden-linux/
 
 **Recent changes:**
 
+## v8.2.0
+
+- **FEATURE**
+  - add support for Ubuntu 24.04
+
 ### v8.1.0
 
 - **OTHER**

meta/main.yml

@@ -12,6 +12,7 @@ galaxy_info:
       versions:
         - "focal"
         - "jammy"
+        - "noble"
   galaxy_tags:
     - networking
     - security

molecule/default/molecule.yml

@@ -64,6 +64,17 @@ platforms:
         network_name: private_network
         type: static
         ip: 172.16.10.50
+  - name: test-harden-linux-ubuntu2404-timesyncd
+    box: alvistack/ubuntu-24.04
+    memory: 2048
+    cpus: 2
+    groups:
+      - timesyncd
+    interfaces:
+      - auto_config: true
+        network_name: private_network
+        type: static
+        ip: 172.16.10.60
 
 provisioner:
   name: ansible
@@ -175,6 +186,20 @@ provisioner:
           - FallbackDNS=149.112.112.112 1.0.0.1 2620:fe::9 2606:4700:4700::1001
           - DNSOverTLS=
           - DNSOverTLS=opportunistic
+      test-harden-linux-ubuntu2404-timesyncd:
+        harden_linux_root_password: "{{ lookup('file', 'myuserpassword_hash') }}" # mypassword
+        harden_linux_ntp: "systemd-timesyncd"
+        harden_linux_ntp_settings:
+          "^#NTP=": "NTP=ntp.ubuntu.com"
+        harden_linux_optional_packages:
+          - mlocate
+        harden_linux_systemd_resolved_settings:
+          - DNS=
+          - DNS=9.9.9.9 1.1.1.1 2606:4700:4700::1111 2620:fe::fe
+          - FallbackDNS=
+          - FallbackDNS=149.112.112.112 1.0.0.1 2620:fe::9 2606:4700:4700::1001
+          - DNSOverTLS=
+          - DNSOverTLS=opportunistic
 
 scenario:
   name: default

tasks/sshguard-ubuntu-24.yml

@@ -0,0 +1,26 @@
+---
+- name: Update UFW before.rules
+  ansible.builtin.blockinfile:
+    path: "/etc/ufw/before.rules"
+    marker: "# {mark} ANSIBLE MANAGED BLOCK"
+    insertafter: "^-A ufw-before-output -o lo -j ACCEPT"
+    block: |
+      # hand off control for sshd to sshguard
+      :sshguard - [0:0]
+      -A ufw-before-input -p tcp --dport {{ harden_linux__ssh_port }} -j sshguard
+  notify:
+    - Reload ufw
+
+- name: Update sshguard whitelist file
+  ansible.builtin.lineinfile:
+    dest: "{{ harden_linux_sshguard_whitelist_file }}"
+    regexp: "^{{ whitelist_entry }}"
+    line: "{{ whitelist_entry }}"
+    state: present
+  loop: "{{ harden_linux_sshguard_whitelist }}"
+  loop_control:
+    loop_var: whitelist_entry
+  notify:
+    - Restart sshguard
+  tags:
+    - sshguard

vars/ubuntu-24.yml

@@ -0,0 +1,5 @@
+---
+harden_linux_sshguard_whitelist_directory: "/etc/sshguard"
+harden_linux_sshguard_whitelist_file: "{{ harden_linux_sshguard_whitelist_directory }}/whitelist"
+
+harden_linux_openntpd_directory: "/etc/openntpd"