--- - name: register os-specific variables include_vars: default.yml when: - ansible_distribution != 'Fedora' - ansible_distribution != 'Archlinux' - name: register os-specific variables include_vars: "{{ ansible_distribution }}.yml" when: - ansible_distribution == 'Fedora' - ansible_distribution == 'Archlinux' - name: Collect all users and groups allowed to login via ssh set_fact: sshd_allow_users: '{{ ["root", "ansible"] + users.keys() | default({}) | sort }}' sshd_allow_groups: '{{ ["root", "admins"] + users.keys() | default({}) | sort }}' - name: Copy sshd configuration template: src: sshd_config dest: '/etc/ssh/sshd_config' owner: root group: root mode: 'u=rw,g=r,o=r' validate: /usr/sbin/sshd -t -f %s become: yes notify: - restart ssh - name: Generate new ed25519 ssh host key pair if necessary command: ssh-keygen -t ed25519 -f 'ssh_host_ed25519_key' -P '' -q args: chdir: '/etc/ssh/' creates: 'ssh_host_ed25519_key.pub' become: yes notify: - restart ssh - name: Remove unwanted host keys file: path: '/etc/ssh/ssh_host_{{ item }}_key' state: absent with_items: - ecdsa - rsa - dsa become: yes notify: - restart ssh - file: path: '/etc/ssh/ssh_host_{{ item }}_key.pub' state: absent with_items: - ecdsa - rsa - dsa become: yes notify: - restart ssh