ansible-role-system/tasks/sshd_config.yml

---
# vim: set expandtab tabstop=2 shiftwidth=2:

- name: 'check sshd include option'
  command: 'sshd -o "include /dev/null"'
  register: sshd_include_option_check
  failed_when: 'sshd_include_option_check.rc not in [1,255] or sshd_include_option_check.stderr not in ["Include directive not supported as a command-line option", "command-line: line 0: Bad configuration option: include"]'
- set_fact:
    sshd_include_option: '{{sshd_include_option_check.stderr == "Include directive not supported as a command-line option"}}'
- when: 'true == sshd_include_option'
  block:
  - name: '/etc/ssh/sshd_config.d'
    file:
      type: directory
      dest: '/etc/ssh/sshd_config.d'
      owner: root
      group: root
      mode: 0644
  - name: 'sshd_config.d/99-default.conf'
    template:
      src:  'sshd-default.conf.j2'
      dest: '/etc/ssh/sshd_config.d/99-default.conf'
      owner:  root
      group:  root
      mode:   0644
  - lineinfile:
      path:         /etc/ssh/sshd_config
      insertbefore: BOF
      regexp:       '^\s*include\s+/etc/ssh/sshd_config.d/'
      line:         'include /etc/ssh/sshd_config.d/*.conf'
      firstmatch:   true
- when: 'false == sshd_include_option'
  block:
  - name: sshd_config
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^\s*#\s*{{item.key}}\s+'
      regexp:      '^\s*{{item.key}}\s'
      line:        '{{item.key}} {{item.value}}'
    with_dict:
      Port:                   '{{sshd_port|default(22)}}'
      PermitRootLogin:        '{{sshd_permit_root_login}}'
      StrictModes:            'yes'
      PubkeyAuthentication:   'yes'
      KerberosAuthentication: '{{sshd_kerberos_authentication|default(omit)}}'
      GSSAPIAuthentication:   '{{sshd_gssapi_authentication|default(omit)}}'
      TCPKeepAlive:           'yes'
      Ciphers:                '{{sshd_ciphers}}'
      MACs:                   '{{sshd_macs}}'
      KexAlgorithms:          '{{sshd_kex_algorithms}}'
  - name: sshd_config
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertbefore: '\s*#?\s*HostKey\s+'
      regexp:       '^# HostKeys for protocol'
      line:         '# HostKeys for protocol'
  - name: sshd_config - prefer ed25519
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^# HostKeys for protocol'
      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
      line:        'HostKey /etc/ssh/ssh_host_ed25519_key'
  - name: sshd_config - fallback rsa
    lineinfile:
      path:        /etc/ssh/sshd_config
      insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
      line:        'HostKey /etc/ssh/ssh_host_rsa_key'
  - name: 'sshd_config - absent dsa / ecdsa'
    lineinfile:
      path:   /etc/ssh/sshd_config
      state:  absent
      regexp: '{{item}}'
    with_list:
    - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
    - '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'