From d62db95075dff19556ba4ddf9af9bfb5025391f0 Mon Sep 17 00:00:00 2001
From: Alexander Gorelyshev <corvus-migratorius@proton.me>
Date: Mon, 8 Jun 2026 11:52:20 +0400
Subject: [PATCH] Make `PermitRootLogin` regexp more generic

---
 roles/sshd/tasks/restrictions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/sshd/tasks/restrictions.yml b/roles/sshd/tasks/restrictions.yml
index 6d14920..dc03159 100644
--- a/roles/sshd/tasks/restrictions.yml
+++ b/roles/sshd/tasks/restrictions.yml
@@ -2,7 +2,7 @@
 - name: "Restrictions | Configure SSH security restrictions"
   loop:
     - { regexp: '^#?Protocol\s+', line: 'Protocol 2' }
-    - { regexp: '^PermitRootLogin yes', line: 'PermitRootLogin no' }
+    - { regexp: '^#?\s*PermitRootLogin\s+', line: 'PermitRootLogin no' }
     - { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
     - { regexp: '^#?IgnoreRhosts', line: 'IgnoreRhosts yes' }
     - { regexp: '^#?DebianBanner\s+', line: 'DebianBanner no' }