From 37222f515e2301e8b6bba41af86da49b2ad0f329 Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Mon, 8 Jun 2026 14:14:09 +0400 Subject: [PATCH] Fix handlers --- roles/sshd/handlers/main.yml | 13 ++++++++++++- roles/sshd/tasks/algorithms.yml | 8 ++++---- roles/sshd/tasks/authentication.yml | 4 ++-- roles/sshd/tasks/encryption.yml | 2 +- roles/sshd/tasks/main.yml | 2 +- roles/sshd/tasks/restrictions.yml | 4 ++-- roles/sshd/tasks/whitelists.yml | 4 ++-- 7 files changed, 24 insertions(+), 13 deletions(-) diff --git a/roles/sshd/handlers/main.yml b/roles/sshd/handlers/main.yml index 9f08055..56ced7d 100644 --- a/roles/sshd/handlers/main.yml +++ b/roles/sshd/handlers/main.yml @@ -1,7 +1,18 @@ --- -- name: "Restart sshd" +- name: "Restart the ssh service" + listen: "Restart ssh" + when: ansible_os_family == 'Debian' ansible.builtin.service: name: ssh state: restarted enabled: true daemon_reload: true + +- name: "Restart the sshd service" + listen: "Restart ssh" + when: ansible_os_family == 'RedHat' + ansible.builtin.service: + name: sshd + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/sshd/tasks/algorithms.yml b/roles/sshd/tasks/algorithms.yml index a43581d..65008c9 100644 --- a/roles/sshd/tasks/algorithms.yml +++ b/roles/sshd/tasks/algorithms.yml @@ -10,7 +10,7 @@ # NOTE: order of preference for openssh-server ed25519 -> rsa - name: "Algorithms | enable ed25519 authentication algorithm" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key' @@ -18,7 +18,7 @@ validate: sshd -f %s -t - name: "Algorithms | enable the RSA authentication algorithm" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^HostKey /etc/ssh/ssh_host_rsa_key' @@ -26,7 +26,7 @@ validate: sshd -f %s -t - name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key' @@ -34,7 +34,7 @@ validate: sshd -f %s -t - name: "Algorithms | disable the DSA algorithm (considered to be defunct)" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^HostKey /etc/ssh/ssh_host_dsa_key' diff --git a/roles/sshd/tasks/authentication.yml b/roles/sshd/tasks/authentication.yml index 8b4e63b..bda73c4 100644 --- a/roles/sshd/tasks/authentication.yml +++ b/roles/sshd/tasks/authentication.yml @@ -1,6 +1,6 @@ --- - name: "Authentication | Configure SSH authentication settings" - notify: Restart sshd + notify: "Restart ssh" loop: - { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' } - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' } @@ -24,7 +24,7 @@ - name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'" when: sshd_cloud_init.stat.exists - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: "/etc/ssh/sshd_config.d/50-cloud-init.conf" regexp: '^#?PasswordAuthentication' diff --git a/roles/sshd/tasks/encryption.yml b/roles/sshd/tasks/encryption.yml index 660a369..d000a35 100644 --- a/roles/sshd/tasks/encryption.yml +++ b/roles/sshd/tasks/encryption.yml @@ -5,7 +5,7 @@ - /etc/ssh/ssh_host_ecdsa_key.pub - /etc/ssh/ssh_host_dsa_key - /etc/ssh/ssh_host_dsa_key.pub - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.file: path: "{{ item }}" state: absent diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml index f567900..2af59f3 100644 --- a/roles/sshd/tasks/main.yml +++ b/roles/sshd/tasks/main.yml @@ -18,7 +18,7 @@ ansible.builtin.include_tasks: "whitelists.yml" - name: "Log at VERBOSE level" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^#?LogLevel' diff --git a/roles/sshd/tasks/restrictions.yml b/roles/sshd/tasks/restrictions.yml index ce29396..86e3703 100644 --- a/roles/sshd/tasks/restrictions.yml +++ b/roles/sshd/tasks/restrictions.yml @@ -31,7 +31,7 @@ validate: /usr/sbin/sshd -t -f %s - name: "Restrictions | toggle PAM" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^#?UsePAM' @@ -39,7 +39,7 @@ validate: sshd -f %s -t - name: "Restrictions | ensure the SSHD config is restricted to the root user" - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.file: path: /etc/ssh/sshd_config owner: root diff --git a/roles/sshd/tasks/whitelists.yml b/roles/sshd/tasks/whitelists.yml index 3952302..9a3d410 100644 --- a/roles/sshd/tasks/whitelists.yml +++ b/roles/sshd/tasks/whitelists.yml @@ -1,7 +1,7 @@ --- - name: "Configure AllowUsers" when: sshd_allow_users is defined - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^#?\s*AllowUsers\s+' @@ -10,7 +10,7 @@ - name: "Configure AllowGroups" when: sshd_allow_groups is defined - notify: Restart sshd + notify: "Restart ssh" ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^#?\s*AllowGroups\s+'