Don't install 'openssh-blacklist' on newer OSes

CHANGES.rst

@@ -44,12 +44,12 @@ Changed
 - Increase the default ``LoginGraceTime`` value from 20 to 30 seconds to help
   solve issues with unresponsive DNS servers. [drybjed_]
 
-Removed
-~~~~~~~
+Deprecated
+~~~~~~~~~~
 
-- Remove the packages ``openssh-blacklist`` and ``openssh-blacklist-extra`` from
-  the list of recommended packages as they are now obsolete. This fixes Debian Stretch support.
-  Refer to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859682 for details. [ypid_]
+- The ``openssh-blacklist*`` Debian packages have been removed from Debian
+  Archive and won't be available in Debian Stretch onwards.
+  Ref: https://bugs.debian.org/859682 [ypid_, drybjed_]
 
 
 `debops.sshd v0.2.5`_ - 2016-10-10

defaults/main.yml

@@ -22,7 +22,9 @@ sshd__base_packages: [ 'openssh-server', 'openssh-client' ]
 # .. envvar:: sshd__recommended_packages [[[
 #
 # List of recommended packages that should be installed with OpenSSH.
-sshd__recommended_packages: []
+sshd__recommended_packages: '{{ [ "openssh-blacklist", "openssh-blacklist-extra" ]
+                                if (ansible_distribution_release in [ "wheezy", "jessie",
+                                    "precise", "trusty", "xenial" ]) else [] }}'
 
                                                                    # ]]]
 # .. envvar:: sshd__optional_packages [[[