Make it configurable to only harden ssh client/server or both (default).

roles/ansible-ssh-hardening/defaults/main.yml

@@ -1,6 +1,10 @@
 # true if IPv6 is needed
 network_ipv6_enable: false              # sshd + ssh
 
+# For which components (client and server) to generate the configuration for. Can be useful when running against a client without an SSH server.
+ssh_client_hardening: true          # ssh
+ssh_server_hardening: true          # sshd
+
 # true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.
 ssh_client_cbc_required: false          # ssh
 ssh_server_cbc_required: false          # sshd

roles/ansible-ssh-hardening/tasks/main.yml

@@ -5,6 +5,8 @@
 - name: create sshd_config and set permissions to root/600
   template: src='opensshd.conf.j2' dest='/etc/ssh/sshd_config' mode=0600 owner=root group=root validate="/usr/sbin/sshd -T -f %s"
   notify: restart sshd
+  when: ssh_server_hardening
 
 - name: create ssh_config and set permissions to root/644
   template: src='openssh.conf.j2' dest='/etc/ssh/ssh_config' mode=0644 owner=root group=root
+  when: ssh_client_hardening