---
- name: Disable password-based SSH root login
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: 'PermitRootLogin prohibit-password'
  notify: restart_sshd

# - name: Disable password authentication
#   lineinfile:
#     path: /etc/ssh/sshd_config
#     regexp: '^PasswordAuthentication'
#     line: 'PasswordAuthentication no'
#   notify: restart_sshd