omni-ansible/tasks/sshd/secure.yml

---
- name: Set parameters in sshd config
  become: true
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ item.match }}"
    line: "{{ item.set }}"
    state: present
  loop:
    - match: "#?PermitRootLogin (yes|no)"
      set: "PermitRootLogin no"
    - match: "#?Banner (none|/etc/issue.net)"
      set: "Banner /etc/issue.net"
    - match: "#?PasswordAuthentication (yes|no)"
      set: "PasswordAuthentication no"
    - match: "#?GSSAPIAuthentication (yes|no)"
      set: "GSSAPIAuthentication no"
    - match: "#?ChallengeResponseAuthentication (yes|no)"
      set: "ChallengeResponseAuthentication no"
  loop_control:
    label: "{{ item.set }}"
  register: _sshd_config_result

- name: Restart sshd service
  when: _sshd_config_result.changed
  become: true
  systemd:
    name: sshd
    state: restarted