Ensure DebianBanner is only handled on Debian derivatives

roles/sshd/tasks/restrictions.yml

@@ -5,8 +5,6 @@
     - { regexp: '^#?\s*PermitRootLogin\s+', line: 'PermitRootLogin no' }
     - { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
     - { regexp: '^#?IgnoreRhosts', line: 'IgnoreRhosts yes' }
-    - { regexp: '^#?DebianBanner\s+', line: 'DebianBanner no' }
-  notify: Restart sshd
     - { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
     - { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
     - { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' }
@@ -16,12 +14,22 @@
     - { regexp: '^#?\s*PermitTunnel\s+', line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no") }}' }
     - { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' }
     - { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' }
+  notify: "Restart ssh"
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: "{{ item.regexp }}"
     line: "{{ item.line }}"
     validate: /usr/sbin/sshd -t -f %s
 
+- name: "Restrictions | disable Debian banner"
+  when: "ansible_os_family == 'Debian'"
+  notify: "Restart ssh"
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?DebianBanner\s+'
+    line: "DebianBanner no"
+    validate: /usr/sbin/sshd -t -f %s
+
 - name: "Restrictions | toggle PAM"
   notify: Restart sshd
   ansible.builtin.lineinfile: