---
- name: Harden SSH configuration
  hosts: all
  become: true
  tasks:
    - name: Ensure root login is disabled
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'
        state: present

    - name: Disable password authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present

    - name: Restart SSH service
      service:
        name: ssh
        state: restarted