---
- name: Ensure latest SSH server and client are installed
  apt:
    pkg: "{{ item }}"
    state: latest
    update_cache: true
    cache_valid_time: "{{ apt_cache_valid_time }}"
  with_items:
    - openssh-server
    - openssh-client
  notify: restart ssh

- name: Create a secure sshd_config
  template:
    src: "{{ sshd_config }}"
    dest: /etc/ssh/sshd_config
    mode: 0600
    validate: '/usr/sbin/sshd -T -f %s'
  notify: restart ssh

- name: Create a secure ssh_config
  template:
    src: "{{ ssh_config }}"
    dest: /etc/ssh/ssh_config
    mode: 0644

---
- name: Ensure latest SSH server and client are installed
  apt:
    pkg: "{{ item }}"
    state: latest
    update_cache: true
    cache_valid_time: "{{ apt_cache_valid_time }}"
  with_items:
    - openssh-server
    - openssh-client
  notify: restart ssh

- name: Create a secure sshd_config
  template:
    src: "{{ sshd_config }}"
    dest: /etc/ssh/sshd_config
    mode: 0600
    validate: '/usr/sbin/sshd -T -f %s'
  notify: restart ssh

- name: Create a secure ssh_config
  template:
    src: "{{ ssh_config }}"
    dest: /etc/ssh/ssh_config
    mode: 0644

- name: Remove Diffie-Hellman moduli of size < 2000
  lineinfile:
    backup: yes
    dest: /etc/ssh/moduli
    regexp: ^(\d+\s){4}1
    state: absent

Remove insecure lines from moduli file
Remove insecure lines from moduli file
