second commit

ansible/roles/os_hardening/tasks/packages.yml

@@ -0,0 +1,33 @@
+---
+# CIS 2.x (Services) / STIG-aequivalent: unsichere Legacy-Dienste/-Clients
+# entfernen, automatische Sicherheitsupdates aktivieren.
+
+- name: Unnoetige/unsichere Pakete entfernen
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: absent
+    purge: true
+  loop:
+    - telnet
+    - rsh-client
+    - talk
+    - nis           # ypbind etc. -- veraltete, unverschluesselte Netzwerkdienste
+    - tftpd-hpa
+    - xinetd
+  ignore_errors: true
+
+- name: Automatische Sicherheitsupdates installieren
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+    update_cache: true
+
+- name: Unattended-upgrades aktivieren
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";