Complete procedures with a way back.

Ansible Missing sudo password and Host key verification failed are separate trust-boundary failures that can appear in the same run. Host key verification happens before remote login and protects the server identity; SSH authentication proves the automation identity; become authentication authorizes privilege escalation after login. This Guide separates those layers, starts with read-only evidence, verifies changed host keys out of band, and restores interactive or noninteractive become without disabling security controls.

Build a pinned ansible-core 2.21 control environment, authenticated SSH inventory, exact roles and collections, named Vault IDs, least-privilege become, check/diff gates, rolling deployment, idempotency proof, and rollback.

Trace the SSH user, host, selected key, agent, server policy, authorized_keys path, permissions, and authentication log before changing access controls.

Use local jail overrides, verify filters against real logs, test bans safely, and retain an unban path.

Introduce per-user keys, validate a drop-in, test a second session, and only then disable password and root login.

Use a dedicated SSH identity, dry-run transfers, build hard-linked snapshots, enforce retention, and test restore.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.