fix(sshd): move login banner to zsh .zprofile

sshd Banner fires on every connection (scp, sftp, non-interactive), the wrong layer for a welcome banner. Move to .zprofile, interactive login shells only.

roles/sshd/defaults/main.yml

@@ -6,7 +6,6 @@ ssh_allowed_networks:
 ssh_users: "jokester" # space separated if many
 ssh_config_dir: "/etc/ssh"
 sshd_config: "{{ ssh_config_dir }}/sshd_config"
-sshd_banner: "{{ ssh_config_dir }}/banner"
 sshd_binary: "/usr/sbin/sshd"
 ssh_authorized_keys_fallback_enabled: false
 ssh_authorized_keys_fallback_dir: "/etc/ssh/authorized_keys"

roles/sshd/tasks/main.yml

@@ -63,14 +63,6 @@
         mode: "0600"
       loop: "{{ ssh_users.split() }}"
 
-- name: Create an SSH banner
-  ansible.builtin.template:
-    src: templates/sshd_banner.j2
-    dest: "{{ sshd_banner }}"
-    owner: root
-    group: root
-    mode: "0644"
-
 - name: Remove motd on Debian
   ansible.builtin.file:
     path: /etc/motd

roles/sshd/templates/sshd_config.j2

@@ -44,9 +44,6 @@ PermitUserEnvironment no
 SyslogFacility AUTH
 LogLevel VERBOSE
 
-# Banner
-Banner /etc/ssh/banner
-
 # SFTP
 Subsystem sftp internal-sftp
 

roles/zsh/tasks/user-setup.yml

@@ -7,6 +7,14 @@
     group: "{{ zsh_user }}"
     mode: "0600"
 
+- name: Setup .zprofile (login banner)
+  ansible.builtin.template:
+    src: zprofile.j2
+    dest: "{{ zsh_home }}/.zprofile"
+    owner: "{{ zsh_user }}"
+    group: "{{ zsh_user }}"
+    mode: "0600"
+
 - name: Setup zsh base config
   ansible.builtin.template:
     src: main.zshrc.j2

roles/zsh/templates/zprofile.j2

@@ -1,3 +1,8 @@
+# {{ ansible_managed }}
+# Login banner - shown once per interactive login shell (before .zshrc / prompt)
+
+if [[ -o interactive ]]; then
+  cat <<'ANSIBLE_BANNER_END'
 {% if ansible_host == 'andromeda' %}
 *******************************************
  Beep beep-wooOOoo! Brrrp! Zzt zzt-whirl!
@@ -67,3 +72,5 @@ JEDI LOST - UNKNOWN STAR SYSTEM
 {% if ansible_hostname is defined %}
 {{ group_names | first }}: {{ ansible_hostname }}
 {% endif %}
+ANSIBLE_BANNER_END
+fi