ssh-server: deploy ssh-config to enable SSHFP checking

ssh-server/tasks/main.yml

@@ -38,6 +38,18 @@
   tags:
     - ssh
 
+- name: ensure ssh is configured
+  template:
+    src: ssh_config.j2
+    dest: /etc/ssh/ssh_config
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+  when: debian_version != "jessie"
+  tags:
+    - ssh
+
 - name: ensure standard pam configuration for sshd
   copy:
     src: pam/sshd

ssh-server/templates/ssh_config → ssh-server/templates/ssh_config.j2

@@ -52,3 +52,4 @@ Host *
     HashKnownHosts yes
     GSSAPIAuthentication yes
     GSSAPIDelegateCredentials no
+    VerifyHostKeyDNS yes