{% set pillar_get = salt['pillar.get'] %}

{% set openssh_server = salt['grains.filter_by']({
    'default': {
        'port': 22,
        'kex_algorithms': [
            'curve25519-sha256@libssh.org',
            'diffie-hellman-group-exchange-sha256',
        ],
        'ciphers': [
            'chacha20-poly1305@openssh.com',
            'aes256-gcm@openssh.com',
            'aes128-gcm@openssh.com',
            'aes256-ctr',
            'aes192-ctr',
            'aes128-ctr',
        ],
        'macs': [
            'hmac-sha2-512-etm@openssh.com',
            'hmac-sha2-256-etm@openssh.com',
            'hmac-ripemd160-etm@openssh.com',
            'umac-128-etm@openssh.com',
            'hmac-sha2-512',
            'hmac-sha2-256',
            'hmac-ripemd160',
            'umac-128@openssh.com',
        ],
        'allow_groups': [
            'ssh',
        ],
        'allow_users': [],
        'minumum_modulus_size': 2048,
        'listen_addresses': [],
        'gateway_ports': 'clientspecified',
    },
}, merge=pillar_get('openssh_server')) %}

{% set pillar_get = salt['pillar.get'] %}

{% set openssh_server = salt['grains.filter_by']({
    'default': {
        'port': 22,
        'kex_algorithms': [
            'curve25519-sha256@libssh.org',
            'diffie-hellman-group-exchange-sha256',
        ],
        'ciphers': [
            'chacha20-poly1305@openssh.com',
            'aes256-gcm@openssh.com',
            'aes128-gcm@openssh.com',
            'aes256-ctr',
            'aes192-ctr',
            'aes128-ctr',
        ],
        'macs': [
            'hmac-sha2-512-etm@openssh.com',
            'hmac-sha2-256-etm@openssh.com',
            'umac-128-etm@openssh.com',
            'hmac-sha2-512',
            'hmac-sha2-256',
            'umac-128@openssh.com',
        ],
        'allow_groups': [
            'ssh',
        ],
        'allow_users': [],
        'minumum_modulus_size': 2048,
        'listen_addresses': [],
        'gateway_ports': 'clientspecified',
    },
}, merge=pillar_get('openssh_server')) %}

Remove ripemd macs for openssh
Remove ripemd macs for openssh

Not supported by newer versions of openssh-server, probably shouldn't be
supported on the older ones either.
