Index: main/waeup-ansible/bootstrap.yml
===================================================================
--- main/waeup-ansible/bootstrap.yml	(revision 15388)
+++ main/waeup-ansible/bootstrap.yml	(revision 15389)
@@ -15,9 +15,11 @@
     # accounts are active.
     permit_ssh_root: true
+    # Allow admin users below to become root w/o entering password?
+    permit_become_root_no_password: true
     # create hashed passwords like this:
     #      $ diceware -d '-' -n 6 --no-caps | tee mypw | mkpasswd -s --method=sha-512 >> mypw
     admin_users:
-      uli:
-        hashed_pw: "$6$W3DjhWuk/dDzw2F$ozaXblaUYnEX6NiS9jg.NYFelyPIV8ySxDJGNwbPpTd.oAnmA.754pntuGT1XP.cAcpkCI5b9zWSgOQ09f5HG1"
+      ulif:
+        hashed_pw: "$6$iuoXy2wO3elWM6d2$NR/ayKF58q0Bm0BdsR.g.Nt5xYzD0s0t17ZjrYaRpY7nkRekjgHTnqw849pK9FdynmNZAioW6oQBQx3BB5kcd0"
 
   roles:
Index: main/waeup-ansible/hosts
===================================================================
--- main/waeup-ansible/hosts	(revision 15388)
+++ main/waeup-ansible/hosts	(revision 15389)
@@ -4,12 +4,17 @@
 [vhosts]
 # localhost:2323 ansible_user=ubuntu ansible_ssh_pass=2d20eb81c5dbe0167f27151c
-v1.waeup.org:2323 ansible_user=ubuntu
+# at least from ubuntu 18.04 on, vagrant is the default user again.
+v1.waeup.org:2322 ansible_user=ubuntu
 v2.waeup.org:2323 ansible_user=ubuntu
-v3.waeup.org:2324 ansible_user=ubuntu
+v3.waeup.org:2324 ansible_user=vagrant
 v4.waeup.org:2325 ansible_user=ubuntu
 v5.waeup.org:2326 ansible_user=ubuntu
+v6.waeup.org:2327 ansible_user=vagrant
 
 
 [bootstrapped]
+gf5.gnufix.de
+gf6.gnufix.de
+gf9.gnufix.de
 h8.waeup.org
 
Index: main/waeup-ansible/playbook-post-reboot.yml
===================================================================
--- main/waeup-ansible/playbook-post-reboot.yml	(revision 15388)
+++ main/waeup-ansible/playbook-post-reboot.yml	(revision 15389)
@@ -97,2 +97,7 @@
     args:
       chdir: /home/vhosts/vhost5
+  - name: Start vagrant vhost6
+    become_user: vhosts
+    command: vagrant up
+    args:
+      chdir: /home/vhosts/vhost6
Index: main/waeup-ansible/roles/openssh/tasks/main.yml
===================================================================
--- main/waeup-ansible/roles/openssh/tasks/main.yml	(revision 15388)
+++ main/waeup-ansible/roles/openssh/tasks/main.yml	(revision 15389)
@@ -8,8 +8,12 @@
     regexp={{ item.regexp }}
   with_items:
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_rsa_key',
+        line: 'HostKey /etc/ssh/ssh_host_rsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_dsa_key',
         line: '# HostKey /etc/ssh/ssh_host_dsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key',
         line: '# HostKey /etc/ssh/ssh_host_ecdsa_key' }
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_ed25519_key',
+        line: 'HostKey /etc/ssh/ssh_host_ed25519_key' }
   notify: "restart sshd"
 
@@ -23,5 +27,7 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure ciphers from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
@@ -30,15 +36,43 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure MACs from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
-    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+    line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
     state=present
   notify: "restart sshd"
 
-- name: "sshd_config - set secure kex algos from bettercrypto.org"
+- name: "sshd_config - set secure MACs from bettercrypto.orgi (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure MACs from bettercrypto.org and ssh-audit.py (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com'
+    state=present
+  notify: "restart sshd"
+
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
   lineinfile:
     dest=/etc/ssh/sshd_config
     line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512'
     state=present
   notify: "restart sshd"
