---
- name: "Restrictions | Configure SSH security restrictions"
  loop:
    - { regexp: '^#?Protocol\s+', line: 'Protocol 2' }
    - { regexp: '^#?\s*PermitRootLogin\s+', line: 'PermitRootLogin no' }
    - { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
    - { regexp: '^#?IgnoreRhosts', line: 'IgnoreRhosts yes' }
    - { regexp: '^#?DebianBanner\s+', line: 'DebianBanner no' }
  notify: Restart sshd
    - { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
    - { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
    - { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' }
    - { regexp: '^#?\s*AllowAgentForwarding\s+', line: 'AllowAgentForwarding {{ sshd_allow_agent_forwarding | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*AllowTcpForwarding\s+', line: 'AllowTcpForwarding {{ sshd_allow_tcp_forwarding | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*GatewayPorts\s+', line: 'GatewayPorts {{ sshd_gateway_ports | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*PermitTunnel\s+', line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' }
    - { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' }
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
    validate: /usr/sbin/sshd -t -f %s

- name: "Restrictions | toggle PAM"
  notify: Restart sshd
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?UsePAM'
    line: "UsePAM {{ sshd_disable_pam | ternary('no', 'yes') }}"
    validate: sshd -f %s -t

- name: "Restrictions | ensure the SSHD config is restricted to the root user"
  notify: Restart sshd
  ansible.builtin.file:
    path: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: "0600"