Wrong ssh_host_keys_group used in RHEL 9

[alvise1988]

Description

I believe there may be an issue with ssh_host_keys_group for EL 9:

• Up to Fedora 37 included, the ssh host keys should belong to the group ssh_keys (see here)
• EL 9 was forked from Fedora 34
• On EL 9, the ssh_hardening role assigns the ssh host keys to the group root (here)
• When adding support for EL 10, the ssh host keys should correctly be assigned to the group root since EL 10 was forked from Fedora 40.

Reproduction steps

---
- name: Configure SSH server for security
  ansible.builtin.include_role:
    name: devsec.hardening.ssh_hardening

Current Behavior

• Clean install of AlmaLinux 9.6
• Apply the ssh_hardening role
• Check the owner of the host keys

[root@... ~]# ls -la /etc/ssh/
[...]
-rw-------. 1 root root [...] ssh_host_ecdsa_key
-rw-r--r--. 1 root root [...] ssh_host_ecdsa_key.pub
-rw-------. 1 root root [...] ssh_host_ed25519_key
-rw-r--r--. 1 root root [...] ssh_host_ed25519_key.pub
-rw-------. 1 root root [...] ssh_host_rsa_key
-rw-r--r--. 1 root root [...] ssh_host_rsa_key.pub

Expected Behavior

• Clean install of AlmaLinux 9.6
• Apply the ssh_hardening role
• Check the owner of the host keys

[root@... ~]# ls -la /etc/ssh/
[...]
-rw-------. 1 root ssh_keys [...] ssh_host_ecdsa_key
-rw-r--r--. 1 root root     [...] ssh_host_ecdsa_key.pub
-rw-------. 1 root ssh_keys [...] ssh_host_ed25519_key
-rw-r--r--. 1 root root     [...] ssh_host_ed25519_key.pub
-rw-------. 1 root ssh_keys [...] ssh_host_rsa_key
-rw-r--r--. 1 root root     [...] ssh_host_rsa_key.pub

OS / Environment

AlmaLinux 9.x (tested on 9.6)

Ansible Version

ansible [core 2.16.14]
  config file = .../ansible.cfg
  configured module search path = ['.../.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = .../.venv/lib/python3.13/site-packages/ansible
  ansible collection location = .../.ansible/collections:/usr/share/ansible/collections
  executable location = .../.venv/bin/ansible
  python version = 3.13.3 (main, Apr  8 2025, 13:54:08) [Clang 16.0.0 (clang-1600.0.26.6)] (.../.venv/bin/python3)
  jinja version = 3.1.5
  libyaml = True

Collection Version

Collection                               Version
---------------------------------------- -------
devsec.hardening                         10.2.0

Additional information

No response