# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low






- name: Disable Kerberos Authentication - Check if the parameter KerberosAuthentication is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+
  register: _sshd_config_has_parameter
- name: Disable Kerberos Authentication - Check if the parameter KerberosAuthentication is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+no$
  register: _sshd_config_correctly
- name: 'Disable Kerberos Authentication'
  block:
    - name: "Deduplicate values from /etc/ssh/sshd_config"
      ansible.builtin.lineinfile:
        path: '/etc/ssh/sshd_config'
        create: no
        regexp: '(?i)(?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+'
        state: 'absent'
    
    - name: 'Check if /etc/ssh/sshd_config.d exists'
      ansible.builtin.stat:
        path: '/etc/ssh/sshd_config.d'
      register: '_etc_ssh_sshd_config_d_exists'
    
    - name: 'Check if the parameter KerberosAuthentication is present in /etc/ssh/sshd_config.d'
      ansible.builtin.find:
        paths: '/etc/ssh/sshd_config.d'
        recurse: 'yes'
        follow: 'no'
        contains: '(?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+'
      register: '_etc_ssh_sshd_config_d_has_parameter'
      when: '_etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir'
    - name: "Remove parameter from files in /etc/ssh/sshd_config.d"
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        create: no
        regexp: '(?i)(?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+'
        state: 'absent'
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: '_etc_ssh_sshd_config_d_has_parameter.matched'
    - name: "Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
      ansible.builtin.lineinfile:
        path: '/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf'
        create: yes
        regexp: '(?i)(?i)^\s*{{ "KerberosAuthentication"| regex_escape }}\s+'
        line: 'KerberosAuthentication no'
        state: present
        insertbefore: 'BOF'
        validate: '/usr/sbin/sshd -t -f %s'
  when: _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
- name: Disable Kerberos Authentication - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
 