# lineinfile - how to hit them all?

**URL:** <https://forum.ansible.com/t/lineinfile-how-to-hit-them-all/35846>\
**Category:** Ansible Project\
**Created:** [October 11, 2021, 7:07pm UTC](https://forum.ansible.com/t/lineinfile-how-to-hit-them-all/35846 "2021-10-11T19:07:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\
**Post date:** [October 11, 2021, 7:07pm UTC](https://forum.ansible.com/t/lineinfile-how-to-hit-them-all/35846/1 "2021-10-11T19:07:59Z")

</div>

My /etc/ssh/sshd\_config after initial installation contains these two lines for some reasons:

#PasswordAuthentication yes

PasswordAuthentication yes

I’m trying to change BOTH to “no” with this statement:

- name: SSH - Disable SSH password authentication and restart OpenSSH at the end  
lineinfile:  
path: /etc/ssh/sshd\_config  
state: present  
line: “{{ item.line }}”  
regexp: “{{ item.regexp }}”  
with\_items:
- { regexp: ‘^#?PermitRootLogin’, line: ‘PermitRootLogin prohibit-password’ }
- { regexp: ‘^#?PasswordAuthentication yes’, line: ‘PasswordAuthentication no’ }  
notify:
- Reload OpenSSH

What baffles me a bit is that it needs two runs to change both occurances:

In the first run the last line is changed. The second run changes the first line.

TASK [SSH - Disable SSH password authentication and restart OpenSSH at the end] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [ubuntuVM] =\> (item={‘regexp’: ‘^#?PermitRootLogin’, ‘line’: ‘PermitRootLogin prohibit-password’})  
changed: [ubuntuVM] =\> (item={‘regexp’: ‘^#?PasswordAuthentication yes’, ‘line’: ‘PasswordAuthentication no’})

TASK [SSH - Disable SSH password authentication and restart OpenSSH at the end] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [ubuntuVM] =\> (item={‘regexp’: ‘^#?PermitRootLogin’, ‘line’: ‘PermitRootLogin prohibit-password’})  
changed: [ubuntuVM] =\> (item={‘regexp’: ‘^#?PasswordAuthentication yes’, ‘line’: ‘PasswordAuthentication no’})

What would I have to do in order to kill two birds with one stone?

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [October 11, 2021, 10:41pm UTC](https://forum.ansible.com/t/lineinfile-how-to-hit-them-all/35846/2 "2021-10-11T22:41:04Z")

</div>

Use the module \*replace\*, e.g.

&nbsp;&nbsp;&nbsp;&nbsp;- replace:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;path: /etc/ssh/sshd\_config  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;regexp: '^(#\*)PasswordAuthentication yes'  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;replace: '\1PasswordAuthentication no'

---

<div class="post-metadata">

**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\
**Post date:** [October 12, 2021, 2:28pm UTC](https://forum.ansible.com/t/lineinfile-how-to-hit-them-all/35846/3 "2021-10-12T14:28:53Z")

</div>

Yes, thanks Vladimir. Found that out by myself already. Works.