patch_openssh.yml

---
- name: Roll out latest openssh packages
  hosts: all
  become: true

  tasks:
    - name: Ensure openssh related packages on Debian based distros are on the latest state
      ansible.builtin.package:
        name:
          - openssh-server
          - openssh-client
          - openssh-sftp-server
        state: latest
        update_cache: true
      notify: Restart openssh service
      when: ansible_facts['os_family'] == "Debian"

    - name: Ensure openssh related packages on EL based distros are on the latest state
      ansible.builtin.package:
        name:
          - openssh
          - openssh-clients
          - openssh-server
        state: latest
        update_cache: true
        update_only: true
      notify: Restart openssh service
      when: ansible_facts['os_family'] == "RedHat"

  handlers:
    - name: Restart openssh service
      ansible.builtin.systemd_service:
        name: sshd
        state: restarted