diff --git a/inventory/prod/hosts.yml b/inventory/prod/hosts.yml
index 8ec348f..a7ac1c4 100644
--- a/inventory/prod/hosts.yml
+++ b/inventory/prod/hosts.yml
@@ -29,8 +29,8 @@ all:
           ansible_host: git.local.mrwho.ru
         vm03:
           ansible_host: 150.251.147.212
-          ansible_ssh_user: root
-          ansible_ssh_password: OdUdPx7yKa4Ga1i              
+#          ansible_ssh_user: root
+#          ansible_ssh_password: OdUdPx7yKa4Ga1i              
 
 #        rocky9-template:
 #          ansible_host: 172.20.21.106
diff --git a/playbooks/rocky9.yml b/playbooks/rocky9.yml
index 1eeddbf..ae673a2 100644
--- a/playbooks/rocky9.yml
+++ b/playbooks/rocky9.yml
@@ -29,7 +29,7 @@
     openssh_permit_root_login: "no"  # Completely disable root SSH
     openssh_challenge_response_auth: false
     # Rate limiting and attack mitigation (OpenSSH 9.8+)
-    openssh_enable_persourcepenalties: true
+    openssh_enable_persourcepenalties: false
     openssh_persource_authfail_penalty: "10s"  # Aggressive penalty
     openssh_persource_maxstartups: "5:30:10"   # Very restrictive
     # Disable all port forwarding
@@ -44,7 +44,7 @@
     openssh_macs:
       - hmac-sha2-512-etm@openssh.com
     # Minimum RSA key size
-    openssh_required_rsa_size: 4096  # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
+    openssh_required_rsa_size: 2048  # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
     # Aggressive session limits
     openssh_max_auth_tries: 2        # (Exceeds PCI DSS 8.3.6 limit of 6)
     openssh_login_grace_time: "20s"
diff --git a/roles/rocky9/tasks/install_packages.yml b/roles/rocky9/tasks/install_packages.yml
index 4a5416a..f059c0f 100644
--- a/roles/rocky9/tasks/install_packages.yml
+++ b/roles/rocky9/tasks/install_packages.yml
@@ -70,6 +70,7 @@
       - qemu-guest-agent
       - cloud-utils-growpart
       - iptraf-ng
+      - python3-firewall
 #      - speedtest-cli
 #      - deltarpm
 #      - screen