state: present

      tags: network,hostname,dns

    # SSH security improvements (EmptyPass, PassAuth, RootLogin)

    - name: Disable SSH Password Auth

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_password_auth.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PasswordAuthentication no

      register: pass_auth

    - name: Remove SSH Password Auth from sshd_config

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PasswordAuthentication"

        line: "# PasswordAuthentication No"

      tags: network,ssh

      register: pass_auth_sshd

    - name: Disable SSH Empty Password

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_empty_password.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PermitEmptyPasswords no

      register: empty_pass

    - name: Remove SSH Empty Password from sshd_config

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitEmptyPasswords"

        line: "# PermitEmptyPasswords No"

      tags: network,ssh

      register: empty_pass_sshd

    - name: Disable SSH Root Login

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_root_login.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PermitRootLogin no

      register: root_login

    - name: Remove SSH Root Login from sshd_config

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitRootLogin"

        line: "# PermitRootLogin No"

      tags: network,ssh

      register: root_login_sshd

    # Create Freifunk Users

    - name: Create member users

      ansible.builtin.user:

        marker: "# {mark} ANSIBLE MANAGED BLOCK / Colorful PS1"

        block: |

          case "$TERM" in

              xterm-color|*-256color) color_prompt=yes;;

          esac

          if [ "$color_prompt" = yes ]; then

              PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '

          else

              PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '

          fi

          unset color_prompt force_color_prompt

    - name: Add SSH key for users from vars

      ansible.posix.authorized_key:

        user: "{{ item.username }}"

        state: present

        key: "{{ lookup('file', item.key_path) }}"

      tags: users

      loop: "{{ users_member | union(users_system) }}"

    - name: Allow for password-less sudo

      community.general.sudoers:

        name: passwordless-sudo

        group: sudo

        commands: ALL

        nopassword: true

    - name: Reload SSHD

      ansible.builtin.service:

        name: "sshd"

        state: "reloaded"

      tags: network,ssh

      when: pass_auth.changed or pass_auth_sshd.changed or empty_pass.changed or empty_pass_sshd.changed or root_login.changed or root_login_sshd.changed