update from gigacoms

roles/openssh/tasks/main.yml

@@ -113,21 +113,21 @@
 - name: Set OpenSSH capability flags
   ansible.builtin.set_fact:
     # Core capabilities for backwards compatibility
-    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
+    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
-    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
+    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
-    openssh_has_fido2: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
+    openssh_has_fido2: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
-    openssh_has_include: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
+    openssh_has_include: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
-    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version >= 8.5 }}"
+    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version is version('8.5', '>=') }}"
-    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version >= 9.3 }}"
+    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version is version('9.3', '>=') }}"
-    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version >= 9.8 }}"
+    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version is version('9.8', '>=') }}"
-    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version >= 9.9 }}"
+    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version is version('9.9', '>=') }}"
     # Algorithm support flags
-    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version >= 7.2 }}"
+    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version is version('7.2', '>=') }}"
-    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
+    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
     # Security restriction flags
-    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
+    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
-    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version >= 9.6 }}"
+    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version is version('9.6', '>=') }}"
-    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version >= 10.0 }}"
+    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version is version('10.0', '>=') }}"
   tags:
     - openssh
     - facts
@@ -139,7 +139,7 @@
     openssh_ca_signature_algorithms: "{{ openssh_ca_signature_algorithms | reject('match', '^sk-') | list }}"
   when:
     - openssh_version is defined
-    - openssh_version < 8.2
+    - openssh_version is version('8.2', '<')
   tags:
     - openssh
     - facts

roles/openssh/templates/sshd_config.j2

@@ -9,7 +9,7 @@ ListenAddress {{ address }}
 {% endfor %}
 
 # Protocol (deprecated directive in newer OpenSSH, kept for compatibility)
-{% if openssh_version is defined and openssh_version < 7.4 %}
+{% if openssh_version is defined and openssh_version is version('7.4', '<') %}
 Protocol {{ openssh_protocol }}
 {% endif %}
 
@@ -153,6 +153,6 @@ GatewayPorts no
 {% if openssh_has_persourcepenalties | default(false) and openssh_enable_persourcepenalties %}
 # Automatic penalties for repeated failures and suspicious behavior
 PerSourcePenalties authfail:{{ openssh_persource_authfail_penalty }} noauth:{{ openssh_persource_noauth_penalty }} crash:{{ openssh_persource_crash_penalty }}
-PerSourceMaxStartups {{ openssh_persource_maxstartups }}
+PerSourceMaxStartups '{{ openssh_persource_maxstartups }}'
 PerSourceNetBlockSize {{ openssh_persource_netblock_ipv4 }}:{{ openssh_persource_netblock_ipv6 }}
 {% endif %}