From 1d5d3c84c1a0a9792f51a8e51e65da128a8fcb78 Mon Sep 17 00:00:00 2001
From: "a.kazantsev" <a.kazantsev@gigacoms.ru>
Date: Fri, 10 Jul 2026 12:02:47 +0300
Subject: [PATCH] update from gigacoms

---
 roles/openssh/tasks/main.yml           | 28 +++++++++++++-------------
 roles/openssh/templates/sshd_config.j2 |  4 ++--
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/roles/openssh/tasks/main.yml b/roles/openssh/tasks/main.yml
index 2f5d253..369a44b 100644
--- a/roles/openssh/tasks/main.yml
+++ b/roles/openssh/tasks/main.yml
@@ -113,21 +113,21 @@
 - name: Set OpenSSH capability flags
   ansible.builtin.set_fact:
     # Core capabilities for backwards compatibility
-    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
-    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
-    openssh_has_fido2: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
-    openssh_has_include: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
-    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version >= 8.5 }}"
-    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version >= 9.3 }}"
-    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version >= 9.8 }}"
-    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version >= 9.9 }}"
+    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
+    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
+    openssh_has_fido2: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
+    openssh_has_include: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
+    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version is version('8.5', '>=') }}"
+    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version is version('9.3', '>=') }}"
+    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version is version('9.8', '>=') }}"
+    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version is version('9.9', '>=') }}"
     # Algorithm support flags
-    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version >= 7.2 }}"
-    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
+    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version is version('7.2', '>=') }}"
+    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
     # Security restriction flags
-    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
-    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version >= 9.6 }}"
-    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version >= 10.0 }}"
+    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
+    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version is version('9.6', '>=') }}"
+    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version is version('10.0', '>=') }}"
   tags:
     - openssh
     - facts
@@ -139,7 +139,7 @@
     openssh_ca_signature_algorithms: "{{ openssh_ca_signature_algorithms | reject('match', '^sk-') | list }}"
   when:
     - openssh_version is defined
-    - openssh_version < 8.2
+    - openssh_version is version('8.2', '<')
   tags:
     - openssh
     - facts
diff --git a/roles/openssh/templates/sshd_config.j2 b/roles/openssh/templates/sshd_config.j2
index cbc8852..c750bd8 100644
--- a/roles/openssh/templates/sshd_config.j2
+++ b/roles/openssh/templates/sshd_config.j2
@@ -9,7 +9,7 @@ ListenAddress {{ address }}
 {% endfor %}
 
 # Protocol (deprecated directive in newer OpenSSH, kept for compatibility)
-{% if openssh_version is defined and openssh_version < 7.4 %}
+{% if openssh_version is defined and openssh_version is version('7.4', '<') %}
 Protocol {{ openssh_protocol }}
 {% endif %}
 
@@ -153,6 +153,6 @@ GatewayPorts no
 {% if openssh_has_persourcepenalties | default(false) and openssh_enable_persourcepenalties %}
 # Automatic penalties for repeated failures and suspicious behavior
 PerSourcePenalties authfail:{{ openssh_persource_authfail_penalty }} noauth:{{ openssh_persource_noauth_penalty }} crash:{{ openssh_persource_crash_penalty }}
-PerSourceMaxStartups {{ openssh_persource_maxstartups }}
+PerSourceMaxStartups '{{ openssh_persource_maxstartups }}'
 PerSourceNetBlockSize {{ openssh_persource_netblock_ipv4 }}:{{ openssh_persource_netblock_ipv6 }}
 {% endif %}