add mitigate_cve-2024-6387.yml

---
- name: Enable temporary mitigation for CVE-2024-6387 "regreSSHion"
  hosts: foreman_rhel9hosts
  become: true
  gather_facts: true

  tasks:
    - name: Change LoginGraceTime to 0 in sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regex: "^(#)?LoginGraceTime"
        line: "LoginGraceTime 0"
        state: present
      notify: Restart sshd
      when: ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_major_version'] == "9"

  handlers:
    - name: Restart sshd
      ansible.builtin.systemd_service:
        name: sshd
        state: restarted