Fix server_hardening role for Docker-based Molecule testing

Add /run/sshd directory creation before sshd_config deploy,
add hardening_ntp_enabled toggle, disable NTP and unattended-upgrades
in Molecule config, and skip verify assertions for disabled features.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: thewismit

roles/server_hardening/defaults/main.yml

@@ -89,6 +89,7 @@ hardening_sysctl_params:
   fs.protected_symlinks: 1
 
 # ── NTP ──────────────────────────────────────────────────────────────────────
+hardening_ntp_enabled: true
 hardening_ntp_service: "systemd-timesyncd"  # or "chrony"
 
 # ── Systemd ──────────────────────────────────────────────────────────────────

roles/server_hardening/molecule/default/molecule.yml

@@ -27,6 +27,8 @@ provisioner:
           - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestKeyForMolecule molecule@test"
         hardening_ufw_enabled: false       # UFW needs kernel modules unavailable in Docker
         hardening_fail2ban_enabled: false   # No systemd journal backend in container
+        hardening_ntp_enabled: false       # No timesyncd/chrony in Docker
+        hardening_unattended_upgrades_enabled: false  # No systemd services in Docker
 
 verifier:
   name: ansible

roles/server_hardening/molecule/default/verify.yml

@@ -89,21 +89,25 @@
       ansible.builtin.stat:
         path: /etc/apt/apt.conf.d/50unattended-upgrades
       register: uu_file
+      when: hardening_unattended_upgrades_enabled | default(true)
 
     - name: VERIFY | Assert unattended upgrades
       ansible.builtin.assert:
         that:
           - uu_file.stat.exists
+      when: hardening_unattended_upgrades_enabled | default(true)
 
     - name: VERIFY | Auto-upgrades configured
       ansible.builtin.stat:
         path: /etc/apt/apt.conf.d/20auto-upgrades
       register: au_file
+      when: hardening_unattended_upgrades_enabled | default(true)
 
     - name: VERIFY | Assert auto-upgrades
       ansible.builtin.assert:
         that:
           - au_file.stat.exists
+      when: hardening_unattended_upgrades_enabled | default(true)
 
     - name: VERIFY | Journal size configured
       ansible.builtin.command: grep -c "SystemMaxUse=500M" /etc/systemd/journald.conf

roles/server_hardening/tasks/ntp.yml

@@ -4,17 +4,23 @@
     name: systemd-timesyncd
     enabled: true
     state: started
-  when: hardening_ntp_service == "systemd-timesyncd"
+  when:
+    - hardening_ntp_enabled
+    - hardening_ntp_service == "systemd-timesyncd"
 
 - name: NTP | Install chrony
   ansible.builtin.apt:
     name: chrony
     state: present
-  when: hardening_ntp_service == "chrony"
+  when:
+    - hardening_ntp_enabled
+    - hardening_ntp_service == "chrony"
 
 - name: NTP | Enable chrony
   ansible.builtin.systemd:
     name: chrony
     enabled: true
     state: started
-  when: hardening_ntp_service == "chrony"
+  when:
+    - hardening_ntp_enabled
+    - hardening_ntp_service == "chrony"

roles/server_hardening/tasks/ssh.yml

@@ -1,4 +1,17 @@
 ---
+- name: SSH | Ensure openssh-server is installed
+  ansible.builtin.apt:
+    name: openssh-server
+    state: present
+
+- name: SSH | Ensure privilege separation directory exists
+  ansible.builtin.file:
+    path: /run/sshd
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: SSH | Deploy hardened sshd_config
   ansible.builtin.template:
     src: sshd_config.j2