--- # vim: set expandtab tabstop=2 shiftwidth=2: - when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]' name: 'sshd_config.d/99-default.conf' template: src: 'sshd-default.conf' dest: '/etc/ssh/sshd_config.d/99-default.conf' owner: root group: root mode: 0644 - when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]' block: - name: sshd_config lineinfile: path: /etc/ssh/sshd_config insertafter: '^\s*#\s*{{item.key}}\s+' regexp: '^\s*{{item.key}}\s' line: '{{item.key}} {{item.value}}' with_dict: Port: '{{ssh_port|default(22)}}' PermitRootLogin: 'prohibit-password' StrictModes: 'yes' PubkeyAuthentication: 'yes' KerberosAuthentication: 'no' GSSAPIAuthentication: 'yes' TCPKeepAlive: 'yes' Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com' MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256' - name: sshd_config lineinfile: path: /etc/ssh/sshd_config insertbefore: '\s*#?\s*HostKey\s+' regexp: '^# HostKeys for protocol' line: '# HostKeys for protocol' - name: sshd_config - prefer ed25519 lineinfile: path: /etc/ssh/sshd_config insertafter: '^# HostKeys for protocol' regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' line: 'HostKey /etc/ssh/ssh_host_ed25519_key' - name: sshd_config - fallback rsa lineinfile: path: /etc/ssh/sshd_config insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$' line: 'HostKey /etc/ssh/ssh_host_rsa_key' - name: 'sshd_config - absent dsa / ecdsa' lineinfile: path: /etc/ssh/sshd_config state: absent regexp: '{{item}}' with_list: - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$' - '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'