manage ssh host keys

defaults/main.yml

@@ -8,10 +8,10 @@ sshd:
   manage_key_types: true
   # choose ssh server allowed key types
   key_types:
-    - ed25519
-    # - rsa
-    # - ecdsa
-    # - dsa # (do not use!)
+    - 'ed25519'
+    # - 'rsa'
+    # - 'ecdsa'
+    # - 'dsa' # (do not use!)
 
   key_algorithmus:
     - 'ssh-ed25519-cert-v01@openssh.com'

tasks/main.yml

@@ -43,7 +43,6 @@
   with_items: "{{ sshd.key_types }}"
   when:
     - sshd.manage_key_types | bool
-- pause:
 
 - name: Remove unwanted host keys
   become: yes
@@ -56,49 +55,22 @@
   notify:
     - systemctrl restart ssh
 
-- name: Remove unwanted host keys
-  become: yes
-  file:
-    path: '/etc/ssh/ssh_host_{{ item }}_key'
-    state: absent
-  with_items:
-    - ecdsa
-    - rsa
-    - dsa
-  notify:
-    - systemctrl restart ssh
-  when:
-    - not generate_ecdsa_too | bool
-    - ansible_distribution_release != 'wheezy'
-    - do_not_delete_legacy_ssh_keys | bool
-
 - name: make sure the correct keys are available
   file:
-    path: '/etc/ssh/ssh_host_{{ item }}_key.pub'
+    path: '/etc/ssh/ssh_host_{{ item }}_key'
     state: absent
   become: yes
   with_items:
-    - ecdsa
-    - rsa
-    - dsa
+    - "{{ sshd_key_types_list | difference( sshd.key_types ) }}"
   notify:
     - systemctrl restart ssh
-  when:
-    - not generate_ecdsa_too | bool
-    - ansible_distribution_release != 'wheezy'
-    - do_not_delete_legacy_ssh_keys | bool
 
-- name: make sure the correct keys are available except ecdsa
+- name: make sure the correct pubkeys are available
   file:
     path: '/etc/ssh/ssh_host_{{ item }}_key.pub'
     state: absent
   become: yes
   with_items:
-    - rsa
-    - dsa
+    - "{{ sshd_key_types_list | difference( sshd.key_types ) }}"
   notify:
     - systemctrl restart ssh
-  when:
-    - generate_ecdsa_too | bool
-    - ansible_distribution_release != 'wheezy'
-    - do_not_delete_legacy_ssh_keys | bool

vars/archlinux.yml

@@ -1,2 +1,10 @@
 ---
 sshd_service: sshd
+sshd_key_types_list:
+  - ed25519
+  - rsa
+  - ecdsa
+  - dsa
+
+sshd_xauth:
+  - xorg-xauth

vars/centos.yml

@@ -1,2 +1,10 @@
 ---
 sshd_service: sshd
+sshd_key_types_list:
+  - ed25519
+  - rsa
+  - ecdsa
+  - dsa
+
+sshd_xauth:
+  - xorg-xauth

vars/default.yml

@@ -1,4 +1,10 @@
 ---
 sshd_service: ssh
+sshd_key_types_list:
+  - ed25519
+  - rsa
+  - ecdsa
+  - dsa
+
 sshd_xauth:
   - xorg-xauth

vars/fedora.yml

@@ -1,2 +1,10 @@
 ---
 sshd_service: sshd
+sshd_key_types_list:
+  - ed25519
+  - rsa
+  - ecdsa
+  - dsa
+
+sshd_xauth:
+  - xorg-xauth