The common role currently selectively modifies portions of the OpenSSH server configuration (/etc/ssh/sshd_config) for hardening purposes.

There are two problems with this:

• Each time support for new distribution release is added, some of the regular expressions may become invalid.
• During upgrades to next distribution release, it is necessary to overwrite the custom modifications and reapply them again to ensure that the configuration file is consistent with distribution defaults.

With the latest two Debian releases (Bullseye/Bookworm), it is possible to instead supply custom configuration using the conf.d mechanism, overriding the settings in the main configuration file. This would make for a way cleaner way to apply the changes, and also negate the issues listed for current configuration method.

The following should be done:

• Update the common and backup_server roles.
  • Switch to using /etc/ssh/sshd_config.d/ directory for deploying customisations.
• Update tests that modify the configuration file to instead place override in the .d directory.
• Figure out if any kind of change would be required for the backup_server role (probably not).
• Update role reference documentation.
• Update usage instructions.
• Update release notes.