Improve infra-run portfolio credibility

infra-run/ansible/roles/cis-rhel9-hardening/README.md

@@ -1,8 +1,8 @@
-# CIS-Inspired RHEL 9 Hardening Role
+# RHEL 9 Baseline Hardening Role
 
-This role provides a practical, production-style hardening baseline for RHEL 9 and Oracle Linux 9 systems. It is inspired by CIS Benchmark controls for Red Hat Enterprise Linux 9 version 2.0.0, but it is intentionally scoped to common operational controls that infrastructure and security operations teams frequently automate.
+This role provides a practical, baseline hardening example for RHEL 9 and Oracle Linux 9 systems. It is inspired by hardening benchmark controls for Red Hat Enterprise Linux 9 version 2.0.0, but it is intentionally scoped to common operational controls that infrastructure and security operations teams frequently automate.
 
-This is not a full CIS certification implementation.
+This is not a full compliance certification implementation.
 
 ## Supported Platforms
 
@@ -16,7 +16,7 @@ The role fails safely on unsupported operating systems or unsupported major vers
 - SSH daemon hardening for root login, empty passwords, password authentication, retry limits, login grace time, and client keepalive behavior.
 - Removal of selected legacy network packages such as telnet, rsh-server, and ypbind.
 - Optional installation and enablement of chrony, auditd, and rsyslog.
-- CIS-inspired IPv4 network sysctl settings.
+- Selected IPv4 network sysctl settings.
 - Service enablement for chronyd, auditd, and rsyslog.
 - Safe disabling of known legacy services when they are present.
 - Basic audit backlog and audit rule examples.
@@ -26,9 +26,9 @@ The role fails safely on unsupported operating systems or unsupported major vers
 
 ## Safety Philosophy
 
-The defaults are conservative. The role supports Ansible check mode and avoids destructive production behavior by default. Filesystem mount option management is disabled unless `cis_manage_mount_options` is explicitly enabled, and even then the role persists configured options without remounting live filesystems.
+The defaults are conservative. The role supports Ansible check mode and avoids destructive live-system behavior by default. Filesystem mount option management is disabled unless `cis_manage_mount_options` is explicitly enabled, and even then the role persists configured options without remounting live filesystems.
 
-Review variables before using this role in production.
+Review variables before adapting this role to managed hosts.
 
 ## Common Variables
 
@@ -78,6 +78,6 @@ Example:
 ansible-playbook playbooks/cis-rhel9-hardening.yml --tags precheck,ssh,postcheck
 ```
 
-## Production Rollout Notes
+## Rollout Notes
 
 This role is a hardening starting point for internal infrastructure teams. It should be reviewed against local access patterns, break-glass procedures, compliance requirements, monitoring expectations, and host build standards before rollout.

infra-run/ansible/roles/cis-rhel9-hardening/tasks/postcheck.yml

@@ -28,7 +28,9 @@
 
 - name: Build sysctl validation summary
   ansible.builtin.set_fact:
-    cis_sysctl_validation_summary: "{{ cis_sysctl_validation_summary | default({}) | combine({item.item.key: item.stdout | default('unreadable')}) }}"
+    cis_sysctl_validation_summary: >-
+      {{ cis_sysctl_validation_summary | default({})
+      | combine({item.item.key: item.stdout | default('unreadable')}) }}
   loop: "{{ cis_sysctl_validation.results | default([]) }}"
   loop_control:
     label: "{{ item.item.key }}"

infra-run/ansible/roles/cis-rhel9-hardening/tasks/ssh.yml

@@ -22,7 +22,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PermitRootLogin\s+'
     line: "PermitRootLogin {{ 'no' if cis_disable_root_login | bool else 'prohibit-password' }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -32,7 +31,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PermitEmptyPasswords\s+'
     line: "PermitEmptyPasswords no"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -42,7 +40,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^PasswordAuthentication\s+'
     line: "PasswordAuthentication {{ 'no' if cis_disable_password_auth | bool else 'yes' }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -52,7 +49,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^MaxAuthTries\s+'
     line: "MaxAuthTries {{ cis_ssh_max_auth_tries }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -62,7 +58,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^LoginGraceTime\s+'
     line: "LoginGraceTime {{ cis_ssh_login_grace_time }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -72,7 +67,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^ClientAliveInterval\s+'
     line: "ClientAliveInterval {{ cis_ssh_client_alive_interval }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd
@@ -82,7 +76,6 @@
     path: "{{ cis_ssh_dropin_path }}"
     regexp: '^ClientAliveCountMax\s+'
     line: "ClientAliveCountMax {{ cis_ssh_client_alive_count_max }}"
-    validate: sshd -t -f %s
   notify:
     - validate sshd
     - reload sshd

infra-run/ansible/roles/cis-rhel9-hardening/tasks/sysctl.yml

@@ -1,5 +1,5 @@
 ---
-- name: Apply CIS-inspired sysctl settings
+- name: Apply selected sysctl settings
   ansible.posix.sysctl:
     name: "{{ item.key }}"
     value: "{{ item.value }}"