sshd-config: for debian-12: config in /etc/ssh/sshd_config.d/default.conf

defaults/main.yml

@@ -2,3 +2,8 @@ has_hwrng:     '{{ansible_virtualization_role != "guest" and ansible_local.devic
 is_virt_guest:         '{{ansible_virtualization_role == "guest"}}'
 is_container:          '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}'
 sys_default_users:     []
+ssh_permit_root_login: 'prohibit-password'
+ssh_ciphers:           'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
+ssh_macs:              'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
+ssh_kex_algorithms:    'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
+ssh_host_keys:         [/etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_rsa_key]

tasks/sshd_config.yml

@@ -1,7 +1,17 @@
 ---
 # vim: set expandtab tabstop=2 shiftwidth=2:
 
-- name: sshd_config
+- when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]'
+  name: 'sshd_config.d/99-default.conf'
+  template:
+    src:  'sshd-default.conf'
+    dest: '/etc/ssh/sshd_config.d/99-default.conf'
+    owner:  root
+    group:  root
+    mode:   0644
+- when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]'
+  block:
+  - name: sshd_config
     lineinfile:
       path: /etc/ssh/sshd_config
       insertafter: '^\s*#\s*{{item.key}}\s+'
@@ -18,25 +28,25 @@
       Ciphers:       'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
       MACs:          'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
       KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
-- name: sshd_config
+  - name: sshd_config
     lineinfile:
       path: /etc/ssh/sshd_config
       insertbefore: '\s*#?\s*HostKey\s+'
       regexp: '^# HostKeys for protocol'
       line: '# HostKeys for protocol'
-- name: sshd_config - prefer ed25519
+  - name: sshd_config - prefer ed25519
     lineinfile:
       path: /etc/ssh/sshd_config
       insertafter: '^# HostKeys for protocol'
       regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
       line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
-- name: sshd_config - fallback rsa
+  - name: sshd_config - fallback rsa
     lineinfile:
       path: /etc/ssh/sshd_config
       insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
       regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
       line: 'HostKey /etc/ssh/ssh_host_rsa_key'
-- name: 'sshd_config - absent dsa / ecdsa'
+  - name: 'sshd_config - absent dsa / ecdsa'
     lineinfile:
       path: /etc/ssh/sshd_config
       state: absent

templates/sshd-default.conf.j2

@@ -0,0 +1,11 @@
+{{if ssh_port is defined             }}Port                   {{ssh_port}}{{endif}}
+PermitRootLogin        {{ssh_permit_root_login}}
+StrictModes            yes
+PubkeyAuthentication   yes
+{{if ssh_kerberos_authentication is defined}}KerberosAuthentication {{ssh_kerberos_authentication}}{{endif}}
+{{if ssh_gssapi_authentication is defined}}GSSAPIAuthentication   {{ssh_gssapi_authentication}}{{endif}}
+TCPKeepAlive           yes
+Ciphers                {{ssh_ciphers}}
+MACs                   {{ssh_macs}}
+KexAlgorithms          {{ssh_kex_algorithms}}
+HostKey                {%for k in ssh_host_keys%}{{k}}{%endfor%}