Only set default for ssh host key files when hardening the server (#393)

Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>
dev-sec · Feb 9, 2021 · f035053 · f035053
1 parent 0cfdb19
commit f035053
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/roles/ssh_hardening/tasks/hardening.yml b/roles/ssh_hardening/tasks/hardening.yml
@@ -33,7 +33,9 @@
 
 - name: set default for ssh_host_key_files if not supplied
   include_tasks: crypto_hostkeys.yml
-  when: not ssh_host_key_files
+  when:
+    - ssh_server_hardening | bool
+    - not ssh_host_key_files
 
 - name: set default for ssh_macs if not supplied
   include_tasks: crypto_macs.yml