From 43730bf5e79d1cf68be234d2270ea6d4390e0df9 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sun, 7 Jun 2026 10:38:46 -0500 Subject: [PATCH] resolvers: fix empty sshd validation command in post-quantum task The 'Validate sshd configuration' task had ansible.builtin.command with no command, so it always errored (one of the following is required: _raw_params, cmd, argv), tripping the rescue that reverts the drop-in. The post-quantum KexAlgorithms hardening therefore never applied. Run sshd -t to validate before restart as intended. --- ansible/roles/resolvers/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/resolvers/tasks/main.yml b/ansible/roles/resolvers/tasks/main.yml index 0af13b9..590017b 100755 --- a/ansible/roles/resolvers/tasks/main.yml +++ b/ansible/roles/resolvers/tasks/main.yml @@ -81,7 +81,7 @@ register: pq_sshd_dropin - name: Validate sshd configuration - ansible.builtin.command: + ansible.builtin.command: /usr/sbin/sshd -t changed_when: false - name: Restart sshd to apply key-exchange change