# platform = multi_platform_ubuntu
# reboot = true
# strategy = restrict
# complexity = low
# disruption = low
- (xccdf-var ssh_approved_macs)

- name: Use Only FIPS 140-3 Validated MACs
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/ssh/ssh_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/ssh_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/ssh_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      state: absent
    when: dupes.found is defined and dupes.found > 1

  - name: Insert correct line to /etc/ssh/ssh_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/ssh_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      line: MACs {{ ssh_approved_macs }}
      state: present
      insertbefore: BOF
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - ssh_use_approved_macs_ordered_stig
