install python3, pip so we can then install pam-tester

Signed-off-by: Sebastian Gumprich <[email protected]>

Author: Sebastian Gumprich

molecule/os_hardening/prepare.yml

@@ -7,19 +7,18 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
+    - name: Install Python3 on Debian 10
+      ansible.builtin.apt:
+        name: python3
+        state: present
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
       ansible.builtin.shell: zypper -n install python-xml
       when: ansible_facts.os_family == 'Suse'

molecule/os_hardening/verify.yml

@@ -20,15 +20,14 @@
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
 
-# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-#    - name: include PAM tests
-#      include_tasks: verify_tasks/pam.yml
-#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
+    - name: Include PAM tests
+      ansible.builtin.include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
 - name: Verify
   hosts: localhost
   environment:

molecule/os_hardening/verify_tasks/pam.yml

@@ -12,9 +12,9 @@
     state: present
     executable: /usr/bin/pip3
 
-- name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+- name: Set password for test
+  ansible.builtin.set_fact:
+    test_pw: myTestpwSage
 
 - name: Set locale for test
   ansible.builtin.set_fact: