add parantheses

Author: Sebastian Gumprich

templates/openssh.conf.j2

@@ -9,7 +9,7 @@
 # ===================
 
 # Address family should always be limited to the active network configuration.
-AddressFamily {{ 'any' if network_ipv6_enable else 'inet' }} 
+AddressFamily {{ 'any' if network_ipv6_enable else 'inet' }}
 # Restrict the following configuration to be limited to this Host.
 {% for host in ssh_remote_hosts -%}
 Host {{host}}
@@ -47,13 +47,13 @@ StrictHostKeyChecking ask
 # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
 #
 {% if ssh_client_cbc_required -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
     Ciphers {{ ssh_ciphers_66_weak | join(',') }}
     {% else -%}
     Ciphers {{ ssh_ciphers_53_weak | join(',') }}
     {% endif %}
 {% else -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
         Ciphers {{ ssh_ciphers_66_default | join(',') }}
     {% else -%}
         Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -65,15 +65,15 @@ StrictHostKeyChecking ask
 # eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
 #
 {% if ssh_client_weak_hmac -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
         MACs {{ ssh_macs_66_weak | join(',') }}
     {% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
     MACs {{ ssh_macs_53_default | join(',') }}
     {% else -%}
     MACs {{ ssh_macs_59_weak | join(',') }}
     {% endif %}
 {% else -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
     MACs {{ ssh_macs_66_default | join(',') }}
     {% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
     MACs {{ ssh_macs_53_default | join(',') }}
@@ -89,7 +89,7 @@ StrictHostKeyChecking ask
 # Weak kex is sometimes required if older package versions are used
 # eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
 #
-{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
    {% if ssh_client_weak_kex -%}
     KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
    {% else -%}

templates/opensshd.conf.j2

@@ -51,13 +51,13 @@ LogLevel VERBOSE
 # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
 #
 {% if ssh_server_cbc_required -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
         Ciphers {{ ssh_ciphers_66_weak | join(',') }}
     {% else %}
         Ciphers {{ ssh_ciphers_53_weak | join(',') }}
     {% endif %}
 {% else -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
         Ciphers {{ ssh_ciphers_66_default | join(',') }}
     {% else -%}
         Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -70,7 +70,7 @@ LogLevel VERBOSE
 #
 
 {% if ssh_server_weak_hmac -%}
-    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+    {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
         MACs {{ ssh_macs_66_weak | join(',') }}
     {% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
         MACs {{ ssh_macs_53_default | join(',') }}
@@ -94,7 +94,7 @@ LogLevel VERBOSE
 # Weak kex is sometimes required if older package versions are used
 # eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
 # based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
-{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
+{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
     {% if ssh_server_weak_kex -%}
         KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
     {% else -%}