main.yml

---

ssh_ciphers:
  - aes256-gcm@openssh.com
  - aes128-gcm@openssh.com
  - aes256-ctr
  - aes192-ctr
  - aes128-ctr

ssh_host_keys:
  - /etc/ssh/ssh_host_ed25519_key
  - /etc/ssh/ssh_host_rsa_key

ssh_host_key_algorithms: '{{ __ssh_audited_key_algorithms }}'

ssh_kex_algorithms: '{{ __ssh_audited_kex_algorithms }}'

ssh_log_level: VERBOSE

ssh_macs:
  - hmac-sha2-512-etm@openssh.com
  - hmac-sha2-256-etm@openssh.com
  - umac-128-etm@openssh.com

ssh_modulus_min: 3071

ssh_permit_root_login: 'no'

ssh_pubkey_accepted_key_types: '{{ __ssh_audited_key_algorithms }}'

ssh_subsystems:
  - name: sftp
    command: '{{ __ssh_audited_sftp_server_location }} -f AUTHPRIV -l INFO'

ssh_opt_out_crypto_policies: yes

...