mrwho/ansible-bootstrap-rocky9
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update from gigacoms

Browse source
This commit is contained in:
a.kazantsev 2026-07-10 12:02:47 +03:00
parent c82974ccb6
commit 1d5d3c84c1
2 changed files with 16 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
roles/openssh/tasks/main.yml
View file

@ -113,21 +113,21 @@
- name: Set OpenSSH capability flags
ansible.builtin.set_fact:
# Core capabilities for backwards compatibility
openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
openssh_has_fido2: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
openssh_has_include: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version >= 8.5 }}"
openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version >= 9.3 }}"
openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version >= 9.8 }}"
openssh_has_mlkem: "{{ openssh_version is defined and openssh_version >= 9.9 }}"
openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
openssh_has_fido2: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
openssh_has_include: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version is version('8.5', '>=') }}"
openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version is version('9.3', '>=') }}"
openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version is version('9.8', '>=') }}"
openssh_has_mlkem: "{{ openssh_version is defined and openssh_version is version('9.9', '>=') }}"
# Algorithm support flags
openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version >= 7.2 }}"
openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version is version('7.2', '>=') }}"
openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
# Security restriction flags
openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
openssh_removes_dsa: "{{ openssh_version is defined and openssh_version >= 9.6 }}"
openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version >= 10.0 }}"
openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
openssh_removes_dsa: "{{ openssh_version is defined and openssh_version is version('9.6', '>=') }}"
openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version is version('10.0', '>=') }}"
tags:
- openssh
- facts
@ -139,7 +139,7 @@
openssh_ca_signature_algorithms: "{{ openssh_ca_signature_algorithms | reject('match', '^sk-') | list }}"
when:
- openssh_version is defined
- openssh_version < 8.2
- openssh_version is version('8.2', '<')
tags:
- openssh
- facts

4
roles/openssh/templates/sshd_config.j2
View file

@ -9,7 +9,7 @@ ListenAddress {{ address }}
{% endfor %}
# Protocol (deprecated directive in newer OpenSSH, kept for compatibility)
{% if openssh_version is defined and openssh_version < 7.4 %}
{% if openssh_version is defined and openssh_version is version('7.4', '<') %}
Protocol {{ openssh_protocol }}
{% endif %}
@ -153,6 +153,6 @@ GatewayPorts no
{% if openssh_has_persourcepenalties | default(false) and openssh_enable_persourcepenalties %}
# Automatic penalties for repeated failures and suspicious behavior
PerSourcePenalties authfail:{{ openssh_persource_authfail_penalty }} noauth:{{ openssh_persource_noauth_penalty }} crash:{{ openssh_persource_crash_penalty }}
PerSourceMaxStartups {{ openssh_persource_maxstartups }}
PerSourceMaxStartups '{{ openssh_persource_maxstartups }}'
PerSourceNetBlockSize {{ openssh_persource_netblock_ipv4 }}:{{ openssh_persource_netblock_ipv6 }}
{% endif %}