diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml
index 2d11bc8..99619d7 100644
--- a/group_vars/all/main.yml
+++ b/group_vars/all/main.yml
@@ -2,11 +2,9 @@
 # Vars for every VPS in the fleet. Keep this file plaintext and readable
 # in diffs - actual secret values live in group_vars/all/vault.yml.
 
+ansible_user: "ansible"
+ansible_port: 25456
 
-# Hardening toggles (see roles/security)
-ssh_permit_root_login: "no"
-ssh_password_authentication: "no"
-ssh_port: 25456
 
 ufw_allowed_tcp_ports:
   - "{{ ssh_port }}"
diff --git a/group_vars/firstrun/main.yml b/group_vars/firstrun/main.yml
index c7dfb3e..fa74e78 100644
--- a/group_vars/firstrun/main.yml
+++ b/group_vars/firstrun/main.yml
@@ -2,7 +2,8 @@
 # vars that are only used for the first setup. after this the defaults change to not use root.
 # this is to setup the ansible user, basic tools and security measures.
 
-# setup needed connection information
+# setup needed connection information, overrides the values in all group
+ansible_user: "root"
 ansible_port: 22
 
 # The non-root user created/used for all future Ansible runs
@@ -14,5 +15,5 @@ deploy_user_ssh_keys:
   - "{{ ssh_key_ansible }}"
 
 timezone: "America/Chicago"
-ufw_allowed_tcp_ports_extra :
+ufw_allowed_tcp_ports_extr:
   - 25456
diff --git a/group_vars/webservers.yml b/group_vars/webservers.yml
index a996fe4..79cc2e9 100644
--- a/group_vars/webservers.yml
+++ b/group_vars/webservers.yml
@@ -7,3 +7,4 @@ nginx_sites:
 ufw_allowed_tcp_ports_extra:
   - 80
   - 443
+
diff --git a/roles/security/defaults/main.yml b/roles/security/defaults/main.yml
index 3e2a095..5e3371b 100644
--- a/roles/security/defaults/main.yml
+++ b/roles/security/defaults/main.yml
@@ -1,2 +1,7 @@
 ---
 security_ufw_allowed_tcp_ports_extra: []
+
+#sshd config
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_port: 25456
\ No newline at end of file