Improper handling of ciphers/macs/kexalgorithms in ssh instance is leading to incorrect sshd instance config

[ReneTrippen]

When in ssh instances the Ciphers/MACs/KexAlgorithms are defined as array or as yaml list, the generated sshd_config of the instance has multiple entries for them, this does not work, because sshd picks only the first match. All allowed ciphers, kex and macs are needed as a comma separated string in the sshd_config.

That's the same issue as in #361. But does not affect the main sshd config, only the instances like an extra sftp server.
I'll fix that and make a PR soon

Example

As Yaml list in hiera

 Ciphers:
   - "aes128-ctr"
   - "aes192-ctr"
   - "aes256-ctr"
 KexAlgorithms:
   - "curve25519-sha256"
   - "[email protected]"
   - "diffie-hellman-group-exchange-sha256"
   - "ecdh-sha2-nistp256"
   - "ecdh-sha2-nistp384"
   - "ecdh-sha2-nistp521"
 MACs:
   - "[email protected]"
   - "[email protected]"
   - "hmac-sha2-512"
   - "hmac-sha2-256"

entries in generated sshd_config.sftp_server

grep -i -E "(^kex|^ciph|^mac)" /etc/ssh/sshd_config.sftp_server
Ciphers aes128-ctr
Ciphers aes192-ctr
Ciphers aes256-ctr
KexAlgorithms curve25519-sha256
KexAlgorithms [email protected]
KexAlgorithms diffie-hellman-group-exchange-sha256
KexAlgorithms ecdh-sha2-nistp256
KexAlgorithms ecdh-sha2-nistp384
KexAlgorithms ecdh-sha2-nistp521
MACs [email protected]
MACs [email protected]
MACs hmac-sha2-512
MACs hmac-sha2-256

sshd -T

sshd -T -f /etc/ssh/sshd_config.sftp_server | grep -E "(^kex|^ciph|^mac)"
ciphers aes128-ctr
macs [email protected]
kexalgorithms curve25519-sha256