sshd_config: non-bookworm uses same vars like bookworm-default.conf.j2; &&/||->and/or

tasks/sshd_config.yml

@@ -1,7 +1,7 @@
 ---
 # vim: set expandtab tabstop=2 shiftwidth=2:
 
-- when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]'
+- when: '"debian" == ansible_facts["os_family"]|lower and 12 <= ansible_facts["os_version_id"]'
   name: 'sshd_config.d/99-default.conf'
   template:
     src:  'sshd-default.conf'
@@ -9,7 +9,7 @@
     owner:  root
     group:  root
     mode:   0644
-- when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]'
+- when: '"debian" != ansible_facts["os_family"]|lower or 11 >= ansible_facts["os_version_id"]'
   block:
   - name: sshd_config
     lineinfile:
@@ -19,15 +19,15 @@
       line:        '{{item.key}} {{item.value}}'
     with_dict:
       Port:                   '{{ssh_port|default(22)}}'
-      PermitRootLogin:        'prohibit-password'
+      PermitRootLogin:        '{{ssh_permit_root_login}}'
       StrictModes:            'yes'
       PubkeyAuthentication:   'yes'
-      KerberosAuthentication: 'no'
-      GSSAPIAuthentication:   'yes'
+      KerberosAuthentication: '{{ssh_kerberos_authentication|default(omit)}}'
+      GSSAPIAuthentication:   '{{ssh_gssapi_authentication|default(omit)}}'
       TCPKeepAlive:           'yes'
-      Ciphers:       'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
-      MACs:          'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
-      KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
+      Ciphers:                '{{ssh_ciphers}}'
+      MACs:                   '{{ssh_macs}}'
+      KexAlgorithms:          '{{ssh_kex_algorithms}}'
   - name: sshd_config
     lineinfile:
       path:        /etc/ssh/sshd_config