ansible-role-system/tasks/sshd_config.yml

---
# vim: set expandtab tabstop=2 shiftwidth=2:

- when: '"debian" == ansible_facts["distribution"]|lower and 12 <= ansible_facts["distribution_version"]|int'
  name: 'sshd_config.d/99-default.conf'
  template:
    src:  'sshd-default.conf.j2'
    dest: '/etc/ssh/sshd_config.d/99-default.conf'
    owner:  root
    group:  root
    mode:   0644
- when: '"debian" != ansible_facts["distribution"]|lower or  11 >= ansible_facts["distribution_version"]|int'
  block:
  - name: sshd_config
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^\s*#\s*{{item.key}}\s+'
      regexp:      '^\s*{{item.key}}\s'
      line:        '{{item.key}} {{item.value}}'
    with_dict:
      Port:                   '{{sshd_port|default(22)}}'
      PermitRootLogin:        '{{sshd_permit_root_login}}'
      StrictModes:            'yes'
      PubkeyAuthentication:   'yes'
      KerberosAuthentication: '{{sshd_kerberos_authentication|default(omit)}}'
      GSSAPIAuthentication:   '{{sshd_gssapi_authentication|default(omit)}}'
      TCPKeepAlive:           'yes'
      Ciphers:                '{{sshd_ciphers}}'
      MACs:                   '{{sshd_macs}}'
      KexAlgorithms:          '{{sshd_kex_algorithms}}'
  - name: sshd_config
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertbefore: '\s*#?\s*HostKey\s+'
      regexp:       '^# HostKeys for protocol'
      line:         '# HostKeys for protocol'
  - name: sshd_config - prefer ed25519
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^# HostKeys for protocol'
      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
      line:        'HostKey /etc/ssh/ssh_host_ed25519_key'
  - name: sshd_config - fallback rsa
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
      line:        'HostKey /etc/ssh/ssh_host_rsa_key'
  - name: 'sshd_config - absent dsa / ecdsa'
    lineinfile:
      path:   /etc/ssh/sshd_config
      state:  absent
      regexp: '{{item}}'
    with_list:
    - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
    - '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'