Ansible turned off password logins on every server and sshd read another file first
/etc/ssh/sshd_config.d/*.conf, and in that directory cloud-init had written 50-cloud-init.conf, containing PasswordAuthentication yes,...all the penetration testers had done. Configuration management sets what a file says. A program decides