- name: disable password access
  become: true
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PasswordAuthentication (true|yes).*$'
    line: 'PasswordAuthentication no'
    backrefs: true
  when: "(ansible_user_id == 'root' or ansible_user_id == 'nanahira' or ansible_user_id == 'mycard' or ansible_user_id == 'zh99998') and not allow_password" # Only self-managed servers
  notify: restart_sshd
- name: permit root login
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PermitRootLogin (no|false|prohibit-password).*$'
    line: 'PermitRootLogin yes'
    backrefs: true
  when: ansible_user_id == 'root' and allow_password
- name: sshd config GSSAPIAuthentication
  become: true
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?GSSAPIAuthentication (true|yes).*$'
    line: 'GSSAPIAuthentication no'
    backrefs: true
  notify: restart_sshd
- name: sshd config UseDNS
  become: true
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?UseDNS (true|yes).*$'
    line: 'UseDNS no'
    backrefs: true
