Enforce Config with Ansible lineinfile

The most common real-world Ansible job isn't building hosts from scratch — it's enforcing settings in existing config files, idempotently, across a fleet. The lineinfile module does exactly that: it ensures a line matching a regexp has a specific value, editing in place. A demo service config lives at /etc/svc-demo.conf with two insecure defaults. Write and run a playbook that hardens it.

Enforce this end state in /etc/svc-demo.conf:

1. PermitRootLogin no (currently 'yes')

2. PasswordAuthentication no (currently 'yes')

The grader checks the file, not your method, but the intended tool is lineinfile with a regexp that matches the existing directive and a line that replaces it. Run locally:

ansible-playbook -i 'localhost,' -c local harden.yml

Using regexp: '^PermitRootLogin ' (anchored) means re-running the play is idempotent and you replace the existing line rather than appending a duplicate.