To prevent users from blowing up their SSH server configuration and locking them out from their servers, we can add a validate to the lineinfile example modifying the sshd_config file in Chapter 10. For example, we created the following task in the May 20 Ansible 101 livestream (see #269):
- name: Make sure SSH is more secure.
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
state: present
validate: 'sshd -t -f %s'
with_items:
- regexp: "^PasswordAuthentication"
line: "PasswordAuthentication no"
- regexp: "^PermitRootLogin"
line: "PermitRootLogin no"
- regexp: "^Port"
line: "Port 2849"
notify: restart ssh