Merged in DCD-1378-trim-ssh-ciphers (pull request #155)

DCD-1378: Add ciphers line to sshd config.

Approved-by: Adam Brokes
Approved-by: Nasser Ghazali-Beiklar

roles/linux_common/tasks/amazon.yml

@@ -7,3 +7,13 @@
       - libxml2
       - git-{{ git_version }}
       - dejavu-sans-fonts
+
+- name: Limit the SSH ciphers
+  lineinfile:
+    path: "/etc/ssh/sshd_config"
+    # Drop insecure ciphers, currently 3des-cbc only. You can get the
+    # full list with `sshd -T | grep -i ciphers`
+    regexp: '^[Cc]iphers'
+    line: "Ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc"
+    insertbefore: "BOF"
+  ignore_errors: yes  # No sshd == no problem