Comment by discardedrefuse

I use Ansible to provision VMs on my "play" server at home (so I'm hardly an expert). That part of my playbook basically does:

* Prompt for username and password

* Create user

* Add it to the wheel group

* Copy over authorized keys

* Edit sshd_config with:

   PermitRootLogin no

   PasswordAuthentication no

   ChallengeResponseAuthentication no

* Restart sshd