I'm not sure what I was thinking but this has nothing to do with the 'u' -
the code is working just as expected since these lines do not yet exist.
What I needed to use was lineinfile, not replace. Changes highlighted below
and it's working now.
> ---
> - hosts: all
> gather_facts: False
> become: True
> vars:
> text_for_EL6:
> - { regexp: '^KexAlgorithms', line: 'KexAlgorithms
> diffie-hellman-group-exchange-sha256' }
> - { regexp: '^MACs', line: 'MACs hmac-sha2-512,hmac-sha2-256' }
> - { regexp: '^Ciphers', line: 'Ciphers
> aes256-ctr,aes192-ctr,aes128-ctr' }
> text_for_EL7:
> - { regexp: '^KexAlgorithms', line: 'KexAlgorithms
> [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
>
> }
> - { regexp: '^Ciphers', line: 'Ciphers [email protected]
> ,[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr'
>
> }
> - { regexp: '^MACs', line: 'MACs [email protected],
> [email protected],[email protected]
> ,hmac-sha2-512,hmac-sha2-256,[email protected]' }
>
> tasks:
> - name: check and store ssh version
> shell: rpm -qa openssh
> register: ssh_version_result
>
> - name: Set ciphers for EL6 - OpenSSL 5.3
> lineinfile:
> backup: yes
> path: /etc/ssh/sshd_config
> regexp: '{{ item.regexp }}'
> line: '{{ item.line }}'
> when: ssh_version_result.stdout.find('openssh-5') != -1
> with_items:
> - "{{text_for_EL6}}"
> notify: restart sshd
>
> - name: Set ciphers for EL7 - OpenSSL > 6.7
> lineinfile:
> backup: yes
> path: /etc/ssh/sshd_config
> regexp: '{{ item.regexp }}'
> line: '{{ item.line }}'
> when: ssh_version_result.stdout.find('openssh-7') != -1
> with_items:
> - "{{text_for_EL7}}"
> notify: restart sshd
>
> handlers:
> - name: restart sshd
> service: name=sshd state=restarted
> ...
>
--
You received this message because you are subscribed to the Google Groups
"Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/62adf586-438e-4543-8776-34253f18eb45%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
