Fix up the SSH config a little

common.yml

@@ -22,7 +22,7 @@
   - name: Gather Facts
     setup:
     
-  - name: Install Updates, Patches and Additional Security Software
+  - name: Install software updates
     apt: update_cache=yes upgrade=dist
 
   - name: Check if reboot is required
@@ -58,12 +58,12 @@
       - { regexp: '^PermitRootLogin.*', line: 'PermitRootLogin without-password', file: '/etc/ssh/sshd_config' }
       - { regexp: '^UseDNS.*', line: 'UseDNS no', file: '/etc/ssh/sshd_config' }
       - { regexp: '^Ciphers', line: 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com', file: '/etc/ssh/sshd_config' } 
-      - { regexp: '^MACs', line: 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256', file: '/etc/ssh/sshd_config' }
-      - { regexp: '^KexAlgorithms', line: 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1', file: '/etc/ssh/sshd_config' }
+      - { regexp: '^MACs', line: 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com', file: '/etc/ssh/sshd_config' }
+      - { regexp: '^KexAlgorithms', line: 'KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384', file: '/etc/ssh/sshd_config' }
     notify:
       - restart ssh      
       
-  - name: PAM config
+  - name: Disable MOTD on login and SSHD
     replace: dest="{{ item.file }}" regexp="{{ item.regexp }}" replace="{{ item.line }}"
     with_items:      
       - { regexp: '^session.*optional.*pam_motd.so.*', line: '# MOTD DISABLED', file: '/etc/pam.d/login' }
@@ -83,7 +83,7 @@
       - unattended-upgrades
       - iptables-persistent
       
-  - name: Unattended-upgrades configured
+  - name: Configure unattended-upgrades
     template: src=50unattended-upgrades.j2 dest=/etc/apt/apt.conf.d/50unattended-upgrades owner=root group=root mode=644
 
   - name: Periodic upgrades configured