add sshd role

roles/sshd/tasks/algorithms.yml

@@ -0,0 +1,33 @@
+---
+# NOTE: order of preference for openssh-server ed25519 -> rsa
+- name: "Algorithms | enable ed25519 authentication algorithm"
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key'
+    line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
+    validate: sshd -f %s -t
+
+- name: "Algorithms | enable the RSA authentication algorithm"
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^HostKey /etc/ssh/ssh_host_rsa_key'
+    line: 'HostKey /etc/ssh/ssh_host_rsa_key'
+    validate: sshd -f %s -t
+
+- name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)"
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key'
+    state: absent
+    validate: sshd -f %s -t
+
+- name: "Algorithms | disable the DSA algorithm (considered to be defunct)"
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^HostKey /etc/ssh/ssh_host_dsa_key'
+    state: absent
+    validate: sshd -f %s -t