sshd: ansible-lint fixes

roles/sshd/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: restart sshd
+- name: Restart sshd
-  service:
+  ansible.builtin.service:
     name: sshd
     state: restarted

roles/sshd/tasks/main.yml

@@ -1,20 +1,19 @@
 ---
-
+- name: Disable AllowAgentForwarding
-- name: disable AllowAgentForwarding
+  ansible.builtin.lineinfile:
-  lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?AllowAgentForwarding'
     line: 'AllowAgentForwarding no'
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: disable ChallengeResponseAuthentication
+- name: Disable ChallengeResponseAuthentication
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^#?ChallengeResponseAuthentication'
     line: 'ChallengeResponseAuthentication no'
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
 # based on mozilla recommended settings
 #   https://infosec.mozilla.org/guidelines/openssh.html
@@ -22,64 +21,64 @@
 #   * prefer aes over chacha for hardware acceleration
 #   * use only ed25519 host key
 #
-- name: disable default crypto policy
+- name: Disable default crypto policy
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/sysconfig/sshd
     regexp: '^(#\s+)?CRYPTO_POLICY='
     line: "CRYPTO_POLICY="
-  notify: restart sshd
+  notify: Restart sshd
   when:
     - ansible_distribution == "CentOS"
     - ansible_distribution_version is version_compare("8", ">=")
 
-- name: tighten ssh kex algorithm
+- name: Tighten ssh kex algorithm
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "KexAlgorithms curve25519-sha256@libssh.org,\
      diffie-hellman-group-exchange-sha256"
     regexp: "^KexAlgorithms .*"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: tighten sshd ciphers
+- name: Tighten sshd ciphers
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,\
      aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
     regexp: "^Ciphers .*"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: tighten sshd macs
+- name: Tighten sshd macs
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "MACs hmac-sha2-512-etm@openssh.com,\
      hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,\
      hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com"
     regexp: "^MACs .*"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: disable ecdsa key from sshd
+- name: Disable ECDSA key from sshd
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "#HostKey /etc/ssh/ssh_host_ecdsa_key"
     regexp: "^#?HostKey /etc/ssh/ssh_host_ecdsa_key"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: disable rsa key from sshd
+- name: Disable RSA key from sshd
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "#HostKey /etc/ssh/ssh_host_rsa_key"
     regexp: "^#?HostKey /etc/ssh/ssh_host_rsa_key"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: enable ed25519 key from sshd
+- name: Enable ed25519 key from sshd
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     line: "HostKey /etc/ssh/ssh_host_ed25519_key"
     regexp: "^#?HostKey /etc/ssh/ssh_host_ed25519_key"
     validate: "sshd -t -f %s"
-  notify: restart sshd
+  notify: Restart sshd