feat: Ubuntu noble

.ansible-lint

@@ -5,6 +5,7 @@ exclude_paths:
   - .markdownlint.yaml
 skip_list:
   - var-naming[no-role-prefix]
+  - meta-runtime[unsupported-version]
 mock_roles:
   - willshersystems.sshd.ansible-sshd
 mock_modules:

.pre-commit-config.yaml

@@ -1,14 +1,14 @@
 ---
 repos:
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.27.1
+    rev: 81e9f98ffd059efe8aa9c1b1a42e5cce61b640c6  # frozen: v1.35.1
     hooks:
       - id: yamllint
         files: \.(yaml|yml)$
         types: [file, yaml]
         entry: yamllint --strict
   - repo: https://github.com/ansible/ansible-lint.git
-    rev: v6.5.2
+    rev: 2d9f1ed1e6d08e1f6a18e50f789ab1580220c7db  # frozen: v24.6.0
     hooks:
       - id: ansible-lint
         files: \.(yaml|yml)$

.yamllint.yml

@@ -4,6 +4,12 @@ ignore: |
   /.tox/
   /.github/
   /tests/roles/
-# skip checking line length
 rules:
+  comments-indentation: false
+  document-start: disable
   line-length: disable
+  braces:
+    max-spaces-inside: 1
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true

CODE_OF_CONDUCT.md

@@ -6,7 +6,7 @@ In the interest of fostering an open and welcoming environment, we as
 contributors and maintainers pledge to making participation in our project and
 our community a harassment-free experience for everyone, regardless of age, body
 size, disability, ethnicity, sex characteristics, gender identity and expression,
-level of experience, education, socio-economic status, nationality, personal
+level of experience, education, socioeconomic status, nationality, personal
 appearance, race, religion, or sexual identity and orientation.
 
 ## Our Standards

README.md

@@ -27,7 +27,7 @@ via simple password. If you need this functionality, be sure to set
 
 Tested on:
 
-* Ubuntu precise, trusty, xenial, bionic, focal, jammy
+* Ubuntu precise, trusty, xenial, bionic, focal, jammy, nobel
   * [![Run tests on Ubuntu latest](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-ubuntu.yml/badge.svg)](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-ubuntu.yml)
 * Debian wheezy, jessie, stretch, buster, bullseye, bookworm
   * [![Run tests on Debian](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-debian-check.yml/badge.svg)](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-debian-check.yml)

handlers/main.yml

@@ -10,7 +10,7 @@
     - ansible_connection != 'chroot'
     - ansible_facts['os_family'] != 'AIX'
     - ansible_facts['os_family'] != 'OpenWrt'
-  listen: reload_sshd
+  listen: Reload_sshd
 
 # sshd on AIX cannot be 'reloaded', it must be Stopped+Started.
 # It's dangerous to do this in two tasks.. you're stopping SSH and then trying to SSH back in to start it.
@@ -25,7 +25,7 @@
     stopsrc -s sshd
     until $(lssrc -s sshd | grep -q inoperative); do sleep 1; done
     startsrc -s sshd
-  listen: reload_sshd
+  listen: Reload_sshd
   changed_when: false
   when:
     - sshd_allow_reload|bool
@@ -39,4 +39,4 @@
   when:
     - sshd_allow_reload|bool
     - ansible_facts['os_family'] == 'OpenWrt'
-  listen: reload_sshd
+  listen: Reload_sshd

meta/main.yml

@@ -18,14 +18,15 @@ galaxy_info:
         - bookworm
     - name: Ubuntu
       versions:
-        - precise
-        - trusty
-        - xenial
         - bionic
         - focal
         - jammy
+        - noble
+        - precise
+        - trusty
+        - xenial
     - name: FreeBSD
-      version:
+      versions:
         - "10.1"
     - name: EL
       versions:

meta/runtime.yml

@@ -0,0 +1,2 @@
+---
+requires_ansible: ">=2.15.0"

tasks/install.yml

@@ -22,7 +22,7 @@
   when:
     - sshd_sysconfig | bool
     - __sshd_sysconfig_supports_use_strong_rng or __sshd_sysconfig_supports_crypto_policy
-  notify: reload_sshd
+  notify: Reload_sshd
 
 - name: Check FIPS mode
   ansible.builtin.include_tasks: check_fips.yml

tasks/install_config.yml

@@ -24,7 +24,7 @@
         {{ sshd_binary }} -t -f %s
       {% endif %}
     backup: "{{ sshd_backup }}"
-  notify: reload_sshd
+  notify: Reload_sshd
 
 - name: Make sure the include path is present in the main sshd_config
   ansible.builtin.lineinfile:
@@ -43,7 +43,7 @@
         {{ sshd_binary }} -t -f %s
       {% endif %}
     backup: "{{ sshd_backup }}"
-  notify: reload_sshd
+  notify: Reload_sshd
   when:
     - sshd_main_config_file is not none
     - sshd_config_file | dirname == sshd_main_config_file ~ '.d'

tasks/install_namespace.yml

@@ -21,4 +21,4 @@
         {{ sshd_binary }} -t -f %s
       {% endif %}
     backup: "{{ sshd_backup }}"
-  notify: reload_sshd
+  notify: Reload_sshd

tasks/install_service.yml

@@ -12,7 +12,7 @@
         owner: root
         group: root
         mode: "0644"
-      notify: reload_sshd
+      notify: Reload_sshd
 
     - name: Install instanced service unit file
       ansible.builtin.template:
@@ -21,7 +21,7 @@
         owner: root
         group: root
         mode: "0644"
-      notify: reload_sshd
+      notify: Reload_sshd
       when:
         - __sshd_socket_accept | bool
 
@@ -32,7 +32,7 @@
         owner: root
         group: root
         mode: "0644"
-      notify: reload_sshd
+      notify: Reload_sshd
 
 - name: Service enabled and running
   ansible.builtin.service:

templates/sshd.socket.j2

@@ -14,6 +14,12 @@ Accept=yes
 {% else %}
 Accept=no
 {% endif %}
+{% if ansible_facts["distribution"]=="Ubuntu" and ansible_facts["distribution_version"] is version('24.04', '>=') %}
+FreeBind=yes
+{% endif %}
 
 [Install]
 WantedBy=sockets.target
+{% if ansible_facts["distribution"]=="Ubuntu" and ansible_facts["distribution_version"] is version('24.04', '>=') %}
+RequiredBy=ssh.service
+{% endif %}

tests/tests_all_options.yml

@@ -93,7 +93,7 @@
           | grep -o '^\(     \|       \)[A-Z][A-Za-z0-9]*\(.\|  \)' \
           | grep -v "[A-Za-z0-9] $" | grep -v "[^A-Za-z0-9 ]$" \
           | awk '{ print $1 }' \
-          | grep -v '^$' | grep -v "^\(Match\|OpenSSH\|The\|Arguments\|Theo\)$"
+          | grep -v '^$' | grep -v "^\(Match\|OpenSSH\|The\|Arguments\|Theo\|Tatu\|Aaron\|Each\)$"
       args:
         executable: /bin/bash
       register: sshd_options

tests/tests_systemd_services.yml

@@ -94,6 +94,7 @@
         #  * I do not think the ConditionPathExists is much useful so skipping on Ubuntu
         #  * Before= does not make any sense in combination with Conflicts=
         #  * I do not think the Description needs to match verbatim either
+        #  * Accept varies in the default file between Ubuntu versions and is explicit anyway
         - name: Construct the options list from old socket file
           ansible.builtin.set_fact:
             __sshd_socket_list: "{{ __sshd_socket_list + [item] }}"
@@ -102,6 +103,7 @@
             - not item.startswith("ConditionPathExists=")
             - not item.startswith("Before=")
             - not item.startswith("Description=")
+            - not item.startswith("Accept=")
           loop:
             "{{ socket_old.splitlines() }}"
 
@@ -118,6 +120,7 @@
         - ansible_facts['service_mgr'] == 'systemd' or
           (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7')
         - ansible_facts['distribution'] != "Debian" or ansible_facts['distribution_major_version'] | int < 12
+        - not (ansible_facts['distribution'] == 'Ubuntu' and ansible_facts['distribution_version'] is version('24.04', '>=')) # 24.04 has no [email protected] in the package
       block:
         - name: Read the distribution instantiated service file
           ansible.builtin.slurp:

vars/Ubuntu_22.yml

@@ -14,6 +14,7 @@ __sshd_defaults:
   Include: /etc/ssh/sshd_config.d/*.conf
   KbdInteractiveAuthentication: false
   UsePAM: true
+  PrintMotd: false
   AcceptEnv: LANG LC_*
   Subsystem: "sftp  /usr/lib/openssh/sftp-server"
 

vars/Ubuntu_24.yml

@@ -0,0 +1,29 @@
+---
+__sshd_os_supported: true
+
+__sshd_service: ssh
+__sshd_packages:
+  - openssh-server
+  - openssh-sftp-server
+# Ubuntu 22.04 shipped with drop-in directory support so we touch
+# just included file with highest priority by default
+__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf
+__sshd_config_mode: "0644"
+# the defaults here represent the defaults shipped in the main sshd_config
+__sshd_defaults:
+  Include: /etc/ssh/sshd_config.d/*.conf
+  KbdInteractiveAuthentication: false
+  UsePAM: true
+  PrintMotd: false
+  AcceptEnv: LANG LC_*
+  Subsystem: "sftp  /usr/lib/openssh/sftp-server"
+
+__sshd_runtime_directory: sshd
+
+__sshd_drop_in_dir_mode: '0755'
+__sshd_main_config_file: /etc/ssh/sshd_config
+
+__sshd_environment_file: /etc/default/ssh
+__sshd_environment_variable: $SSHD_OPTS
+__sshd_service_after: auditd.service
+__sshd_service_alias: sshd