homeserver/roles/mgrote.deactivate_ssh_password_login/tasks/main.yml

---
  - name: prohibit ssh login with password
    become: yes
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      regexp: '#PasswordAuthentication yes'
      line: 'PasswordAuthentication no'
      state: present
      validate: "/usr/sbin/sshd -T -f %s"
    notify: restart_sshd

  - name: prohibit ssh login with password
    become: yes
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      regexp: 'PasswordAuthentication yes'
      line: 'PasswordAuthentication no'
      state: present
      validate: "/usr/sbin/sshd -T -f %s"
    notify: restart_sshd


  - name: prohibit ssh root login with password
    become: yes
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      regexp: 'PermitRootLogin yes'
      line: 'PermitRootLogin no'
      state: present
      validate: "/usr/sbin/sshd -T -f %s"
    notify: restart_sshd