Fix handlers

roles/sshd/handlers/main.yml

@@ -1,7 +1,18 @@
 ---
-- name: "Restart sshd"
+- name: "Restart the ssh service"
+  listen: "Restart ssh"
+  when: ansible_os_family == 'Debian'
   ansible.builtin.service:
     name: ssh
     state: restarted
     enabled: true
     daemon_reload: true
+
+- name: "Restart the sshd service"
+  listen: "Restart ssh"
+  when: ansible_os_family == 'RedHat'
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+    enabled: true
+    daemon_reload: true

roles/sshd/tasks/algorithms.yml

@@ -10,7 +10,7 @@
 
 # NOTE: order of preference for openssh-server ed25519 -> rsa
 - name: "Algorithms | enable ed25519 authentication algorithm"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key'
@@ -18,7 +18,7 @@
     validate: sshd -f %s -t
 
 - name: "Algorithms | enable the RSA authentication algorithm"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^HostKey /etc/ssh/ssh_host_rsa_key'
@@ -26,7 +26,7 @@
     validate: sshd -f %s -t
 
 - name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key'
@@ -34,7 +34,7 @@
     validate: sshd -f %s -t
 
 - name: "Algorithms | disable the DSA algorithm (considered to be defunct)"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^HostKey /etc/ssh/ssh_host_dsa_key'

roles/sshd/tasks/authentication.yml

@@ -1,6 +1,6 @@
 ---
 - name: "Authentication | Configure SSH authentication settings"
-  notify: Restart sshd
+  notify: "Restart ssh"
   loop:
     - { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
     - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' }
@@ -24,7 +24,7 @@
 
 - name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'"
   when: sshd_cloud_init.stat.exists
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
     regexp: '^#?PasswordAuthentication'

roles/sshd/tasks/encryption.yml

@@ -5,7 +5,7 @@
     - /etc/ssh/ssh_host_ecdsa_key.pub
     - /etc/ssh/ssh_host_dsa_key
     - /etc/ssh/ssh_host_dsa_key.pub
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.file:
     path: "{{ item }}"
     state: absent

roles/sshd/tasks/main.yml

@@ -18,7 +18,7 @@
   ansible.builtin.include_tasks: "whitelists.yml"
 
 - name: "Log at VERBOSE level"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?LogLevel'

roles/sshd/tasks/restrictions.yml

@@ -31,7 +31,7 @@
     validate: /usr/sbin/sshd -t -f %s
 
 - name: "Restrictions | toggle PAM"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?UsePAM'
@@ -39,7 +39,7 @@
     validate: sshd -f %s -t
 
 - name: "Restrictions | ensure the SSHD config is restricted to the root user"
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.file:
     path: /etc/ssh/sshd_config
     owner: root

roles/sshd/tasks/whitelists.yml

@@ -1,7 +1,7 @@
 ---
 - name: "Configure AllowUsers"
   when: sshd_allow_users is defined
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?\s*AllowUsers\s+'
@@ -10,7 +10,7 @@
 
 - name: "Configure AllowGroups"
   when: sshd_allow_groups is defined
-  notify: Restart sshd
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?\s*AllowGroups\s+'