path: root/roles/host/tasks/ssh-harden.yml

- name: Disable SSH password authentication
  ansible.builtin.lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PasswordAuthentication"
    line: "PasswordAuthentication no"
    state: "present"
    validate: "sshd -t -f %s"
  notify:
    - Restart sshd