playbook-sshd.yml

---
- hosts: all
  become: true
  become_user: root
  become_method: sudo

  tasks:
    - name: do not allow root login via ssh
      lineinfile: backrefs=yes state=present dest=/etc/ssh/sshd_config regexp="^PermitRootLogin yes" line="PermitRootLogin no"
      notify: reload sshd

    - name: do not allow password auth via ssh
      lineinfile: backrefs=yes state=present dest=/etc/ssh/sshd_config regexp="#PasswordAuthentication yes" line="PasswordAuthentication no"
      notify: reload sshd

    - name: restrict listening interface
      lineinfile:
              state=present
              dest=/etc/ssh/sshd_config
              regexp="^ListenAddress {{ ansible_default_ipv4.address }}"
              line="ListenAddress {{ ansible_default_ipv4.address }}"
      when: ansible_default_ipv4.address != "127.0.0.1"
      notify: reload sshd

  handlers:
    - name: reload sshd
      service: name=sshd state=restarted enabled=true
      when: ansible_distribution == 'CentOS'

    - name: reload sshd
      service: name=ssh state=restarted enabled=true
      when: ansible_distribution == 'Ubuntu'