systemctl status sshd.service reveals the “Loaded” (and optional “Drop-In”) unit file(s).
By default that is
/usr/lib/systemd/system/sshd.service, which in turn has lines:
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
The ‘reload’ sends
SIGHUP? What does sshd do on HUP?
# man sshd | grep -1 HUP
fied in the configuration file. sshd rereads its configuration file when
it receives a hangup signal, SIGHUP, by executing itself with the name
and options it was started with, e.g. /usr/sbin/sshd.
Sounds like the reload is sufficient, but restart is probably ok too.
I’d set the task that modifies file to notify handler (if the task is in a role) and the handler could
- name: Restart SSHD
The option ‘state’ of ‘systemd’ module:
# ansible-doc systemd | grep -A6 -- "- state"
'started'/'stopped' are idempotent actions that will not run
commands unless necessary. 'restarted' will always bounce the
unit. 'reloaded' will always reload.
choices: [reloaded, restarted, started, stopped]
Alternatively, the handler could use module ‘service’ and be slightly more generic:
# ansible-doc service | head -7
> ANSIBLE.BUILTIN.SERVICE (/usr/lib/python3.11/site-packages/ansible/modules/service.py)
Controls services on remote hosts. Supported init systems
include BSD init, OpenRC, SysV, Solaris SMF, systemd, upstart.
This module acts as a proxy to the underlying service manager
module. While all arguments will be passed to the underlying
module, not all modules support the same arguments. This
How did you disable the IPv6?
In the early days it was possible to blacklist the ipv6 kernel module, etc, but more recently that has been too harsh; something depends (or did) on it. These days I have mere
ipv6.method ignore on NetworkManager connections.
For example, the
rhel-system-roles.network sets that with:
- name: myconn
Each interface still has the linklocal
inet6 fe80::* address and services do listen, so IPv6 is not totally off.
One could/should complement that by blocking IPv6 at the firewall too.