Improve infra-run portfolio credibility

infra-run/ansible/roles/cis-debian-ubuntu-hardening/README.md

@@ -1,6 +1,6 @@
-# CIS-Inspired Debian and Ubuntu Hardening
+# Debian And Ubuntu Baseline Hardening Role
 
-This role applies a small, practical set of CIS-inspired operational hardening controls for Debian and Ubuntu servers. It is intentionally readable, conservative, and suitable as a baseline for production environments that still need local review.
+This role applies a small, practical set of selected baseline operational hardening controls for Debian and Ubuntu servers. It is intentionally readable, conservative, and suitable as a baseline for managed environments that still need local review.
 
 ## Supported OS
 
@@ -11,7 +11,7 @@ Unsupported distributions and versions fail during precheck before hardening tas
 
 ## Implemented Areas
 
-- SSH daemon hardening with a validated drop-in configuration
+- SSH daemon hardening through a managed drop-in and final `sshd -t` validation
 - Legacy network package removal
 - Optional installation and enablement of `auditd`, `chrony`, `rsyslog`, and `sudo`
 - Kernel network sysctl hardening
@@ -31,7 +31,7 @@ The defaults are intended to be operationally safe:
 - Services are enabled only when the matching feature is enabled and the service exists.
 - Existing logging configuration is not replaced.
 
-This role does not implement the full CIS benchmark and is not a CIS certification implementation.
+This role does not implement the full CIS benchmark and is not a compliance certification implementation.
 
 ## Usage
 

infra-run/ansible/roles/cis-debian-ubuntu-hardening/tasks/postcheck.yml

@@ -37,12 +37,16 @@
   ansible.builtin.set_fact:
     cis_package_validation_summary:
       legacy_absent: "{{ cis_legacy_packages | difference(ansible_facts.packages.keys() | list) }}"
-      hardening_present: "{{ (cis_enabled_hardening_packages | default(cis_hardening_packages)) | intersect(ansible_facts.packages.keys() | list) }}"
+      hardening_present: >-
+        {{ (cis_enabled_hardening_packages | default(cis_hardening_packages))
+        | intersect(ansible_facts.packages.keys() | list) }}
       audit_present: "{{ cis_audit_packages | intersect(ansible_facts.packages.keys() | list) }}"
 
 - name: Build sysctl validation summary
   ansible.builtin.set_fact:
-    cis_sysctl_validation_summary: "{{ cis_sysctl_validation_summary | default({}) | combine({item.item.key: item.stdout | default('unreadable')}) }}"
+    cis_sysctl_validation_summary: >-
+      {{ cis_sysctl_validation_summary | default({})
+      | combine({item.item.key: item.stdout | default('unreadable')}) }}
   loop: "{{ cis_sysctl_validation.results | default([]) }}"
   loop_control:
     label: "{{ item.item.key }}"
@@ -65,7 +69,7 @@
 - name: Publish validation summary
   ansible.builtin.set_fact:
     cis_validation_summary:
-      benchmark: "CIS-inspired controls for Debian 13 Trixie and Ubuntu Server 26.04 LTS"
+      benchmark: "selected controls for Debian 13 Trixie and Ubuntu Server 26.04 LTS"
       sshd_config: "{{ 'OK' if cis_sshd_validate.rc == 0 else 'CRITICAL' }}"
       services: "{{ cis_service_state_summary }}"
       packages: "{{ cis_package_validation_summary }}"

infra-run/ansible/roles/cis-debian-ubuntu-hardening/tasks/ssh.yml

@@ -33,7 +33,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PermitRootLogin\s+'
     line: "PermitRootLogin {{ 'no' if cis_disable_root_login | bool else 'prohibit-password' }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -43,7 +42,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PermitEmptyPasswords\s+'
     line: "PermitEmptyPasswords no"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -53,7 +51,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PasswordAuthentication\s+'
     line: "PasswordAuthentication {{ 'no' if cis_disable_password_auth | bool else 'yes' }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -63,7 +60,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^MaxAuthTries\s+'
     line: "MaxAuthTries {{ cis_ssh_max_auth_tries }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -73,7 +69,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^LoginGraceTime\s+'
     line: "LoginGraceTime {{ cis_ssh_login_grace_time }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -83,7 +78,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^ClientAliveInterval\s+'
     line: "ClientAliveInterval {{ cis_ssh_client_alive_interval }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh
@@ -93,7 +87,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^ClientAliveCountMax\s+'
     line: "ClientAliveCountMax {{ cis_ssh_client_alive_count_max }}"
-    validate: sshd -t -f %s
   notify:
     - validate ssh
     - restart ssh

infra-run/ansible/roles/cis-debian-ubuntu-hardening/tasks/sysctl.yml

@@ -1,5 +1,5 @@
 ---
-- name: Apply CIS-inspired sysctl settings
+- name: Apply selected sysctl settings
   ansible.posix.sysctl:
     name: "{{ item.key }}"
     value: "{{ item.value }}"