Hosts already configured keep their ChallengeResponseAuthentication lines; the new name appends alongside harmlessly.

Assisted-by: GLM-5.3 via pi

diff --git a/hopeless-masquerade/main.yml b/hopeless-masquerade/main.yml
index dd17129..b505bbf 100644
--- a/hopeless-masquerade/main.yml
+++ b/hopeless-masquerade/main.yml
@@ -51,37 +51,8 @@
         name: en_US.UTF-8
         state: present
 
-# TODO Standardize these into a shared playbook
-- name: Secure the system
-  hosts: hopeless-masquerade
-  become: true
-  tasks:
-
-    - name: Disable SSH password logins
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: '^(#\s*)?{{ item }} '
-        line: "{{ item }} no"
-      with_items:
-        - ChallengeResponseAuthentication
-        - PasswordAuthentication
-        - UsePAM
-      notify: Restart sshd
-
-    - name: Allow sudo without password
-      ansible.builtin.lineinfile:
-        path: /etc/sudoers
-        regexp: '^%sudo'
-        line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
-        validate: 'visudo -cf %s'
-
-  handlers:
-    - name: Restart sshd
-      ansible.builtin.systemd:
-        name: sshd
-        state: restarted
-
 # TODO disallow network access from non-tailscale interfaces
+- import_playbook: ../playbooks/secure.yml # noqa: name[play]
 - import_playbook: ../playbooks/tailscale.yml # noqa: name[play]
 
 # https://setup.vector.dev
diff --git a/legacy-of-lunatic-kingdom/main.yml b/legacy-of-lunatic-kingdom/main.yml
index e46d513..5be1b71 100644
--- a/legacy-of-lunatic-kingdom/main.yml
+++ b/legacy-of-lunatic-kingdom/main.yml
@@ -65,37 +65,8 @@
         name: prometheus-node-exporter
         state: restarted
 
-# TODO Standardize these into a shared playbook
-- name: Secure the system
-  hosts: legacy-of-lunatic-kingdom
-  become: true
-  tasks:
-
-    - name: Disable SSH password logins
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: '^(#\s*)?{{ item }} '
-        line: "{{ item }} no"
-      with_items:
-        - ChallengeResponseAuthentication
-        - PasswordAuthentication
-        - UsePAM
-      notify: Restart sshd
-
-    - name: Allow sudo without password
-      ansible.builtin.lineinfile:
-        path: /etc/sudoers
-        regexp: '^%sudo'
-        line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
-        validate: 'visudo -cf %s'
-
-  handlers:
-    - name: Restart sshd
-      ansible.builtin.systemd:
-        name: sshd
-        state: restarted
-
 # TODO disallow network access from non-tailscale interfaces
+- import_playbook: ../playbooks/secure.yml              # noqa: name[play]
 - import_playbook: ../playbooks/tailscale.yml           # noqa: name[play]
 - import_playbook: ../playbooks/podman.yml              # noqa: name[play]
 - import_playbook: caddy.yml                            # noqa: name[play]
diff --git a/playbooks/secure.yml b/playbooks/secure.yml
new file mode 100644
index 0000000..eb27810
--- /dev/null
+++ b/playbooks/secure.yml
@@ -0,0 +1,30 @@
+- name: Secure the system
+  hosts: "{{ ansible_limit | default([]) }}"
+  become: true
+  tasks:
+
+    - name: Disable SSH password logins
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^(#\s*)?{{ item }} '
+        line: "{{ item }} no"
+      loop:
+        - KbdInteractiveAuthentication
+        - PasswordAuthentication
+        - UsePAM
+      notify: Restart sshd
+
+    - name: Allow sudo without password
+      ansible.builtin.lineinfile:
+        path: /etc/sudoers
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
+        validate: 'visudo -cf %s'
+
+  handlers:
+    - name: Restart sshd
+      ansible.builtin.systemd:
+        name: sshd
+        state: restarted
+
+# vim: ft=yaml.ansible