update..

roles/common/templates/etc/ssh/sshd_config.j2

@@ -147,9 +147,15 @@ PasswordAuthentication {{ sshd_password_authentication }}
 # The default is “no”.
 PermitEmptyPasswords no
 
+{% if (ansible_facts['distribution'] == "Debian") and (ansible_facts['distribution_major_version']|int > 11) %}
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+KbdInteractiveAuthentication no
+{% else %}
 # Specifies whether challenge-response authentication is allowed (e.g. via PAM).
 # The default is “yes”.
 ChallengeResponseAuthentication no
+{% endif %}
 
 # Don't read the user's ~/.rhosts and ~/.shosts files
 IgnoreRhosts yes