From 989170dc92de91950c61dd6af89a3948be9d8cc3 Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Fri, 10 Jul 2026 14:56:53 +0200
Subject: [PATCH 1/2] remove willshersystems.sshd

apply the same configuration settings, and drop willshersystems.sshd
from galaxy requirements
---
 ansible/requirements/ansible-galaxy.yml       |  4 +---
 ansible/roles/ssh_users/tasks/main.yml        | 16 ++++++++--------
 ansible/roles/ssh_users/templates/allow_users |  0
 ansible/roles/ssh_users/templates/sshd_config |  9 +++++++++
 4 files changed, 18 insertions(+), 11 deletions(-)
 create mode 100644 ansible/roles/ssh_users/templates/allow_users
 create mode 100644 ansible/roles/ssh_users/templates/sshd_config

diff --git a/ansible/requirements/ansible-galaxy.yml b/ansible/requirements/ansible-galaxy.yml
index 997d7a83..730768b8 100644
--- a/ansible/requirements/ansible-galaxy.yml
+++ b/ansible/requirements/ansible-galaxy.yml
@@ -1,6 +1,4 @@
 roles: 
-  - src: willshersystems.sshd
-    version: v0.25.0
   - src: nginxinc.nginx
     version: 0.24.3
   - src: geerlingguy.certbot
@@ -18,4 +16,4 @@ roles:
     version: 7.4.7
 collections: 
   - name: community.docker # manages containers
-    version: 4.6.1
\ No newline at end of file
+    version: 4.6.1
diff --git a/ansible/roles/ssh_users/tasks/main.yml b/ansible/roles/ssh_users/tasks/main.yml
index 6ab0e805..3615a9ba 100644
--- a/ansible/roles/ssh_users/tasks/main.yml
+++ b/ansible/roles/ssh_users/tasks/main.yml
@@ -52,16 +52,16 @@
     mode: 0400
   with_items: "{{ admin_usernames | union(non_admin_usernames) }}"
 
-- name: configure sshd
+- name: configure sshd_config
   tags: ssh_users
-  include_role:
-    name: willshersystems.sshd
-  vars:
-    sshd_skip_defaults: false
-    sshd:
-      AllowUsers: "{{ admin_usernames | union(non_admin_usernames) | sort | join(' ') }}"
+  template:
+    src: sshd_config
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: 0440
 
-- name: Enesure sudoers dir exists
+- name: Ensure sudoers dir exists
   tags: ssh_users
   ansible.builtin.file:
     path: /etc/sudoers.d
diff --git a/ansible/roles/ssh_users/templates/allow_users b/ansible/roles/ssh_users/templates/allow_users
new file mode 100644
index 00000000..e69de29b
diff --git a/ansible/roles/ssh_users/templates/sshd_config b/ansible/roles/ssh_users/templates/sshd_config
new file mode 100644
index 00000000..a8b1ea5a
--- /dev/null
+++ b/ansible/roles/ssh_users/templates/sshd_config
@@ -0,0 +1,9 @@
+Include /etc/ssh/sshd_config.d/*.conf
+AllowUsers {{ admin_usernames | union(non_admin_usernames) | sort | join(' ') }}
+PasswordAuthentication No
+KbdInteractiveAuthentication no
+UsePAM yes
+X11Forwarding yes
+PrintMotd no
+AcceptEnv LANG LC_*
+Subsystem	sftp	/usr/lib/openssh/sftp-server

From 3cb3fbad48464b7980215b4fa7eb4d16fbda37b8 Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Fri, 10 Jul 2026 15:41:34 +0200
Subject: [PATCH 2/2] Set sshd Ciphers and KexAlgorithms

---
 ansible/roles/ssh_users/templates/sshd_config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ansible/roles/ssh_users/templates/sshd_config b/ansible/roles/ssh_users/templates/sshd_config
index a8b1ea5a..6f7b1273 100644
--- a/ansible/roles/ssh_users/templates/sshd_config
+++ b/ansible/roles/ssh_users/templates/sshd_config
@@ -7,3 +7,6 @@ X11Forwarding yes
 PrintMotd no
 AcceptEnv LANG LC_*
 Subsystem	sftp	/usr/lib/openssh/sftp-server
+Ciphers chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+KexAlgorithms mlkem768x25519-sha256,curve25519-sha256
+MACs hmac-sha2-512,hmac-sha2-256