ssh: explicitly enable or disable the service at boot

[Byh0ki]

Hello,

This PR aims to explicitly allow someone to enable or disable the sshd service at boot. They are 2 main reasons/use cases:

1. We should not trust the distro/package manager default state for the service. We should explicitly set the "enabled" setting at true or false if it's what we want to
2. Even given the usual need of a always on sshd for a Ansible user, Ansible can also be used with a local connexion. For example, I'm planning on using this role to configure sshd on a laptop, I don't need the service up and running at each boot but I would still like to benefit from the hardened settings when I'm starting it to transfer some files or to work on my laptop from a remote computer.

Hopefully my variable naming is not too confusing, maybe we could rename the ssh_server_enabled var but this would create a braking change :/

S.

[rndmh3ro]

Why did you add become here?

[Byh0ki]

I've copied the behavior from the handlers/main.yml but I've just realized that the become is already passed as an arg in tasks/main.yml, I'll correct this part.

In the mean time, shouldn't we also check that the package is installed with

- name: Install openssh
  ansible.builtin.package:
    name: "{{ ssh_pkg_name }}"
    state: present

for the same reasons I listed above? The role is almost complete (from a "I want to have a functioning ssh server or client" POV) and it seems quite strange to install and enable the service outside of this role. I'm curious about your thoughts on that

[rndmh3ro]

In the past, we always assumed that ssh is installed. But since we're now already changing how ssh is started (see https://github.com/dev-sec/ansible-collection-hardening/blob/master/roles/ssh_hardening/tasks/disable-systemd-socket.yml) I don't see any reason not to install it, too.

Do you want to create an additional PR for this?

[Byh0ki]

Indeed, I'll create an MR for that if it's ok for you?

[rndmh3ro]

Yes, please. :)