Turn off SSH password and root login

sshd accepted passwords from the internet (about 12,000 failed logins a
day) and root logins with a key. Keys only now, no root, no X11 forwarding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/tasks/main.yml

@@ -25,3 +25,19 @@
     content: |
       APT::Periodic::Update-Package-Lists "1";
       APT::Periodic::Unattended-Upgrade "1";
+
+# Keys only. sshd_config's Include comes first and sshd keeps the first value
+# it reads, so this drop-in overrides the defaults further down. Root has no
+# keys, and Ansible logs in as the regular user.
+- name: SSH - keys only, no root login, no X11
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/10-hardening.conf
+    owner: root
+    mode: '0644'
+    content: |
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      PermitRootLogin no
+      X11Forwarding no
+    validate: /usr/sbin/sshd -t -f %s
+  notify: reload ssh