000-harden-ssh-server.yml

---
- hosts: all
  become: yes
  tasks:
    - name: Set empty password for ansible user (https://unix.stackexchange.com/a/193131/311426)
      user:
        name: ansible
        password: "*"
        password_lock: false

    - name: Harden SSH configuration
      lineinfile:
        path: "/etc/ssh/sshd_config"
        regexp: "^(#)?{{ item.key }}"
        line: "{{ item.key }} {{ item.value }}"
        backup: yes
        state: present
      loop:
        - { key: "PermitRootLogin", value: "no" }
        - { key: "PasswordAuthentication", value: "no" }
        - { key: "PermitEmptyPasswords", value: "no" }
      loop_control:
        label: "{{ item.key }}"
      notify: Restart SSH

  handlers:
    - name: Restart SSH
      service:
        name: sshd
        state: restarted