From 14bcc89e5d5052f2e56ac71611dafd7ce8b3d6ca Mon Sep 17 00:00:00 2001
From: Sergey Malyuk <malyuk.ss@genlab.llc>
Date: Thu, 18 Dec 2025 11:54:32 +0300
Subject: [PATCH] fix role and ansible-lint errors

---
 roles/sshd/defaults/main.yml           |  8 ++++----
 roles/sshd/meta/main.yml               |  4 ++--
 roles/sshd/molecule/default/verify.yml |  3 ++-
 roles/sshd/tasks/algorithms.yml        |  9 +++++++++
 roles/sshd/tasks/authentication.yml    | 12 ++++++------
 roles/sshd/tasks/install.yml           |  1 +
 roles/sshd/tasks/restrictions.yml      |  2 +-
 7 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/roles/sshd/defaults/main.yml b/roles/sshd/defaults/main.yml
index 7f8dce0..5354282 100644
--- a/roles/sshd/defaults/main.yml
+++ b/roles/sshd/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-disable_pam: false
-password_auth: false
-challenge_response_auth: false
-gss_api_auth: false
+sshd_disable_pam: false
+sshd_password_auth: false
+sshd_challenge_response_auth: false
+sshd_gss_api_auth: false
diff --git a/roles/sshd/meta/main.yml b/roles/sshd/meta/main.yml
index 45b38d2..7158cf1 100644
--- a/roles/sshd/meta/main.yml
+++ b/roles/sshd/meta/main.yml
@@ -10,8 +10,8 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: [ "focal", "jammy" ]
+      versions: ["focal", "jammy"]
 
-  galaxy_tags: [ ]
+  galaxy_tags: []
 
 dependencies: []
diff --git a/roles/sshd/molecule/default/verify.yml b/roles/sshd/molecule/default/verify.yml
index 50508d7..6287e65 100644
--- a/roles/sshd/molecule/default/verify.yml
+++ b/roles/sshd/molecule/default/verify.yml
@@ -6,5 +6,6 @@
   any_errors_fatal: true
 
   tasks:
-    - name: blank
+    - name: Blank
       ansible.builtin.command: echo
+      changed_when: false
diff --git a/roles/sshd/tasks/algorithms.yml b/roles/sshd/tasks/algorithms.yml
index 3eb0150..a43581d 100644
--- a/roles/sshd/tasks/algorithms.yml
+++ b/roles/sshd/tasks/algorithms.yml
@@ -1,4 +1,13 @@
 ---
+# next task requires this directory to exist for sshd -t flag
+- name: Ensure /run/sshd exists
+  ansible.builtin.file:
+    path: /run/sshd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
 # NOTE: order of preference for openssh-server ed25519 -> rsa
 - name: "Algorithms | enable ed25519 authentication algorithm"
   notify: Restart sshd
diff --git a/roles/sshd/tasks/authentication.yml b/roles/sshd/tasks/authentication.yml
index 26b690a..8b4e63b 100644
--- a/roles/sshd/tasks/authentication.yml
+++ b/roles/sshd/tasks/authentication.yml
@@ -3,13 +3,13 @@
   notify: Restart sshd
   loop:
     - { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
-    - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ password_auth | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' }
     - { regexp: '^#?\s*PermitEmptyPasswords\s+', line: 'PermitEmptyPasswords no' }
-    - { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ challenge_response_auth | ternary("yes", "no") }}' }
-    - { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ gss_api_auth | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ sshd_challenge_response_auth | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ sshd_gss_api_auth | ternary("yes", "no") }}' }
     - {
       regexp: '^#?\s*AuthenticationMethods\s+',
-      line: "{{ 'AuthenticationMethods publickey password' if password_auth else 'AuthenticationMethods publickey' }}"
+      line: "{{ 'AuthenticationMethods publickey password' if sshd_password_auth else 'AuthenticationMethods publickey' }}"
     }
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
@@ -22,10 +22,10 @@
   ansible.builtin.stat:
     path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
 
-- name: "Authentication | override password authentication by cloud-init to '{{ password_auth | ternary('yes', 'no') }}'"
+- name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'"
   when: sshd_cloud_init.stat.exists
   notify: Restart sshd
   ansible.builtin.lineinfile:
     path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
     regexp: '^#?PasswordAuthentication'
-    line: 'PasswordAuthentication {{ password_auth | ternary("yes", "no") }}'
+    line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}'
diff --git a/roles/sshd/tasks/install.yml b/roles/sshd/tasks/install.yml
index 1940c90..ff03595 100644
--- a/roles/sshd/tasks/install.yml
+++ b/roles/sshd/tasks/install.yml
@@ -10,3 +10,4 @@
   ansible.builtin.apt:
     name: openssh-server
     state: present
+    update_cache: true
diff --git a/roles/sshd/tasks/restrictions.yml b/roles/sshd/tasks/restrictions.yml
index 723a007..6d14920 100644
--- a/roles/sshd/tasks/restrictions.yml
+++ b/roles/sshd/tasks/restrictions.yml
@@ -18,7 +18,7 @@
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?UsePAM'
-    line: "UsePAM {{ disable_pam | ternary('no', 'yes') }}"
+    line: "UsePAM {{ sshd_disable_pam | ternary('no', 'yes') }}"
     validate: sshd -f %s -t
 
 - name: "Restrictions | ensure the SSHD config is restricted to the root user"