README.md

@@ -12,14 +12,14 @@ If you are running this role with older versions of OpenSSH, such as version 5.3
 This is the default in this role.
 
 ```yaml
-openssh_kexalgorithms:
+ssh_kexalgorithms:
   - curve25519-sha256@libssh.org
   - ecdh-sha2-nistp521
   - ecdh-sha2-nistp384
   - ecdh-sha2-nistp256
   - diffie-hellman-group-exchange-sha256
 
-openssh_ciphers:
+ssh_ciphers:
   - chacha20-poly1305@openssh.com
   - aes256-gcm@openssh.com
   - aes128-gcm@openssh.com
@@ -27,7 +27,7 @@ openssh_ciphers:
   - aes192-ctr
   - aes128-ctr
 
-openssh_macs:
+ssh_macs:
   - hmac-sha2-512-etm@openssh.com
   - hmac-sha2-256-etm@openssh.com
   - umac-128-etm@openssh.com
@@ -38,9 +38,8 @@ openssh_macs:
 
 ### Mozilla Intermediate
 ```yaml
-openssh_hostkeys:
+ssh_hostkey_file: /etc/ssh/ssh_host_rsa_key
-  - /etc/ssh/ssh_host_rsa_key
+ssh_hostkey_file: /etc/ssh/ssh_host_ecdsa_key
-  - /etc/ssh/ssh_host_ecdsa_key
 
 ssh_kexalgorithms:
   - diffie-hellman-group-exchange-sha256

defaults/main.yaml

@@ -7,11 +7,6 @@ openssh_address_family: any
 openssh_listen_addresses:
   - 0.0.0.0
 
-openssh_hostkeys:
-  - /etc/ssh/ssh_host_ed25519_key
-  - /etc/ssh/ssh_host_ecdsa_key
-  - /etc/ssh/ssh_host_rsa_key
-
 openssh_allow_groups: ssh
 openssh_login_grace_time: 20
 openssh_permit_root_login: 'no'

tasks/template_config.yaml

@@ -19,4 +19,4 @@
     src: issue.net.j2
     dest: "{{ openssh_banner_file }}"
     mode: '0644'
-  when: openssh_banner
+  when: ssh_banner

templates/sshd_config.j2

@@ -6,10 +6,12 @@ AddressFamily {{ openssh_address_family }}
 ListenAddress {{ a }}
 {% endfor %}
 
-{% if openssh_hostkeys is defined %}
+{% if openssh_hostkey_file is defined %}
-{% for hostkey in openssh_hostkeys %}
+HostKey {{ openssh_hostkey_file }}
-HostKey {{ hostkey }}
+{% else %}
-{% endfor %}
+HostKey /etc/ssh/openssh_host_ecdsa_key
+HostKey /etc/ssh/openssh_host_ed25519_key
+HostKey /etc/ssh/openssh_host_rsa_key
 {% endif %}
 
 {% if openssh_kexalgorithms is defined %}