---
- name: disable password authentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PasswordAuthentication\s'
    line: 'PasswordAuthentication no'
    validate: '/usr/sbin/sshd -t -f %s'
  notify: restart sshd

- name: enable root authentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PermitRootLogin\s'
    line: 'PermitRootLogin prohibit-password'
    validate: '/usr/sbin/sshd -t -f %s'
  notify: restart sshd