openssh: cleanup playblook + role

playbooks/openssh.yml

@@ -4,11 +4,11 @@
     - pve_network
     - vm_network
   vars:
-    openssh_users_ca_public_key:
+    openssh__users_ca_public_key:
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAAB\
       hBIpT7d7WeR88bs53KkNkZNOzkPJ7CQ5Ui6Wl9LXzAjjIdH+hKJieBMHrKew7+kzxGYaTqXW\
       F1fQWsACG6aniy7VZpsdgTaNw7qr9frGfmo950V7IlU6w1HRc5c+3oVBWpg=="
-    openssh_authorized_principals:
+    openssh__authorized_principals:
       - any
       - "{{ inventory_hostname }}"
   roles:

roles/openssh_server/defaults/main.yml

@@ -1,4 +1,25 @@
 ---
-openssh_authorized_principals:
+openssh__authorized_principals:
   - any
+# https://infosec.mozilla.org/guidelines/openssh.html
+openssh__kex_algorithms:
+  - curve25519-sha256@libssh.org
+  - ecdh-sha2-nistp521
+  - ecdh-sha2-nistp384
+  - ecdh-sha2-nistp256
+  - diffie-hellman-group-exchange-sha256
+openssh__ciphers:
+  - chacha20-poly1305@openssh.com
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+openssh__macs:
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - umac-128-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - umac-128@openssh.com
 ...

roles/openssh_server/tasks/main.yml

@@ -21,7 +21,7 @@
 
 - name: Install Users CA public key
   copy:
-    content: "{{ openssh_users_ca_public_key }}"
+    content: "{{ openssh__users_ca_public_key }}"
     dest: /etc/ssh/users_ca.pub
     owner: root
     group: root
@@ -30,7 +30,7 @@
 
 - name: Install authorized principals file
   copy:
-    content: "{{ openssh_authorized_principals | join('\n') }}"
+    content: "{{ openssh__authorized_principals | join('\n') }}"
     dest: /etc/ssh/authorized_principals
     owner: root
     group: root

roles/openssh_server/templates/sshd_config.j2

@@ -15,10 +15,9 @@ HostKey /etc/ssh/ssh_host_ed25519_key
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 
-# https://infosec.mozilla.org/guidelines/openssh.html
+KexAlgorithms {{ openssh__kex_algorithms | join(",") }}
-KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+Ciphers {{ openssh__ciphers | join(",") }}
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs {{ openssh__macs | join(",") }}
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 
 AuthenticationMethods publickey