Converts ssh ciphers and kex vars to lists

The vars represent information that is best understood as a list, and
therefore should be stored as a list, and interpolated as a
comma-separated string only at the presentation layer, when rendering
the template.

Storing the vars as lists is eminently more readable, which encourages
a deeper understanding of this role, and of the SSH service in general.

Author: conorsch

vars/main.yml

@@ -1,22 +1,55 @@
 ssh_ps53: 'yes'
 ssh_ps59: 'sandbox'
 
-ssh_macs_53_default: 'hmac-ripemd160,hmac-sha1'
-ssh_macs_59_default: 'hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
-ssh_macs_59_weak: '{{ssh_macs_59_default + ",hmac-sha1"}}'
-ssh_macs_66_default: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
-ssh_macs_66_weak: '{{ssh_macs_66_default + ",hmac-sha1"}}'
-
-ssh_ciphers_53_default: 'aes256-ctr,aes192-ctr,aes128-ctr'
-ssh_ciphers_53_weak: '{{ssh_ciphers_53_default + ",aes256-cbc,aes192-cbc,aes128-cbc"}}'
-
-ssh_ciphers_66_default: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
-ssh_ciphers_66_weak: '{{ssh_ciphers_66_default + ",aes256-cbc,aes192-cbc,aes128-cbc"}}'
-
-ssh_kex_59_default: 'diffie-hellman-group-exchange-sha256'
-ssh_kex_59_weak: '{{ssh_kex_59_default + ",diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"}}'
-ssh_kex_66_default: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
-ssh_kex_66_weak: '{{ssh_kex_66_default + ",diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"}}'
+ssh_macs_53_default:
+  - hmac-ripemd160
+  - hmac-sha1
+
+ssh_macs_59_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - hmac-ripemd160
+
+ssh_macs_59_weak: "{{ ssh_macs_59_default + ['hmac-sha1'] }}"
+
+ssh_macs_66_default:
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - hmac-ripemd160-etm@openssh.com
+  - umac-128-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - hmac-ripemd160
+
+ssh_macs_66_weak: "{{ ssh_macs_66_default + ['hmac-sha1'] }}"
+
+ssh_ciphers_53_default:
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_ciphers_53_weak: "{{ ssh_ciphers_53_default + ['aes256-cbc', 'aes192-cbc', 'aes128-cbc'] }}"
+
+ssh_ciphers_66_default:
+  - chacha20-poly1305@openssh.comi
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_ciphers_66_weak: "{{ ssh_ciphers_66_default + ['aes256-cbc', 'aes192-cbc', 'aes128-cbc'] }}"
+
+ssh_kex_59_default:
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_59_weak: "{{ ssh_kex_59_default + ['diffie-hellman-group14-sha1', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group1-sha1'] }}"
+
+ssh_kex_66_default:
+  - curve25519-sha256@libssh.org
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_66_weak: "{{ ssh_kex_66_default + ['diffie-hellman-group14-sha1', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group1-sha1'] }}"
 
 # directory where to store ssh_password policy
 ssh_custom_selinux_dir: '/etc/selinux/local-policies'