---
# CIS 2.x (Services) / STIG-aequivalent: unsichere Legacy-Dienste/-Clients
# entfernen, automatische Sicherheitsupdates aktivieren.

- name: Unnoetige/unsichere Pakete entfernen
  ansible.builtin.apt:
    name: "{{ item }}"
    state: absent
    purge: true
  loop:
    - telnet
    - rsh-client
    - talk
    - nis           # ypbind etc. -- veraltete, unverschluesselte Netzwerkdienste
    - tftpd-hpa
    - xinetd
  ignore_errors: true

- name: Automatische Sicherheitsupdates installieren
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present
    update_cache: true

- name: Unattended-upgrades aktivieren
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";