diff --git a/tasks/sshd_config.yml b/tasks/sshd_config.yml
index 904100a..650f31b 100644
--- a/tasks/sshd_config.yml
+++ b/tasks/sshd_config.yml
@@ -1,7 +1,7 @@
 ---
 # vim: set expandtab tabstop=2 shiftwidth=2:
 
-- when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]'
+- when: '"debian" == ansible_facts["os_family"]|lower and 12 <= ansible_facts["os_version_id"]'
   name: 'sshd_config.d/99-default.conf'
   template:
     src:  'sshd-default.conf'
@@ -9,47 +9,47 @@
     owner:  root
     group:  root
     mode:   0644
-- when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]'
+- when: '"debian" != ansible_facts["os_family"]|lower or 11 >= ansible_facts["os_version_id"]'
   block:
   - name: sshd_config
     lineinfile:
-      path: /etc/ssh/sshd_config
+      path:        /etc/ssh/sshd_config
       insertafter: '^\s*#\s*{{item.key}}\s+'
-      regexp: '^\s*{{item.key}}\s'
-      line: '{{item.key}} {{item.value}}'
+      regexp:      '^\s*{{item.key}}\s'
+      line:        '{{item.key}} {{item.value}}'
     with_dict:
       Port:                   '{{ssh_port|default(22)}}'
-      PermitRootLogin:        'prohibit-password'
+      PermitRootLogin:        '{{ssh_permit_root_login}}'
       StrictModes:            'yes'
       PubkeyAuthentication:   'yes'
-      KerberosAuthentication: 'no'
-      GSSAPIAuthentication:   'yes'
+      KerberosAuthentication: '{{ssh_kerberos_authentication|default(omit)}}'
+      GSSAPIAuthentication:   '{{ssh_gssapi_authentication|default(omit)}}'
       TCPKeepAlive:           'yes'
-      Ciphers:       'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
-      MACs:          'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
-      KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
+      Ciphers:                '{{ssh_ciphers}}'
+      MACs:                   '{{ssh_macs}}'
+      KexAlgorithms:          '{{ssh_kex_algorithms}}'
   - name: sshd_config
     lineinfile:
-      path: /etc/ssh/sshd_config
+      path:        /etc/ssh/sshd_config
       insertbefore: '\s*#?\s*HostKey\s+'
-      regexp: '^# HostKeys for protocol'
-      line: '# HostKeys for protocol'
+      regexp:       '^# HostKeys for protocol'
+      line:         '# HostKeys for protocol'
   - name: sshd_config - prefer ed25519
     lineinfile:
-      path: /etc/ssh/sshd_config
+      path:        /etc/ssh/sshd_config
       insertafter: '^# HostKeys for protocol'
-      regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
-      line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
+      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
+      line:        'HostKey /etc/ssh/ssh_host_ed25519_key'
   - name: sshd_config - fallback rsa
     lineinfile:
-      path: /etc/ssh/sshd_config
+      path:        /etc/ssh/sshd_config
       insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
-      regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
-      line: 'HostKey /etc/ssh/ssh_host_rsa_key'
+      regexp:      '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
+      line:        'HostKey /etc/ssh/ssh_host_rsa_key'
   - name: 'sshd_config - absent dsa / ecdsa'
     lineinfile:
-      path: /etc/ssh/sshd_config
-      state: absent
+      path:   /etc/ssh/sshd_config
+      state:  absent
       regexp: '{{item}}'
     with_list:
     - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'