24.4. Overriding the system-wide cryptographic policy on an SSH server by using the sshd RHEL system role

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Deploy SSH configuration for OpenSSH server
     hosts: managed-node-01.example.com
     tasks:
       - name: Overriding the system-wide cryptographic policy
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.sshd
         vars:
           sshd_sysconfig: true
           sshd_sysconfig_override_crypto_policy: true
           sshd_KexAlgorithms: ecdh-sha2-nistp521
           sshd_Ciphers: aes256-ctr
           sshd_MACs: hmac-sha2-512-etm@openssh.com
           sshd_HostKeyAlgorithms: rsa-sha2-512,rsa-sha2-256

   The settings specified in the example playbook include the following:

   sshd_KexAlgorithms

   You can choose key exchange algorithms, for example, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,diffie-hellman-group14-sha1, or diffie-hellman-group-exchange-sha256.

   sshd_Ciphers

   You can choose ciphers, for example, aes128-ctr, aes192-ctr, or aes256-ctr.

   sshd_MACs

   You can choose MACs, for example, hmac-sha2-256, hmac-sha2-512, or hmac-sha1.

   sshd_HostKeyAlgorithms

   You can choose a public key algorithm, for example, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-rsa.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file on the control node.

   注意

   On RHEL 9 managed nodes, the system role writes the configuration into the /etc/ssh/sshd_config.d/00-ansible_system_role.conf file, where cryptographic options are applied automatically. You can change the file by using the sshd_config_file variable. However, to ensure the configuration is effective, use a file name that lexicographically precedes the /etc/ssh/sshd_config.d/50-redhat.conf file, which includes the configured crypto policies.

   On RHEL 8 managed nodes, you must enable override by setting the sshd_sysconfig_override_crypto_policy and sshd_sysconfig variables to true.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml