Two stage bootstrap of a Vagrant/Ansible provisioning environment to get rid of the insecure vagrant user account.

firstrun.yml

---
- hosts: servers
  sudo: yes
  tasks:
    - name: stuff for unpriv user
      user: name={{ unpriv_user }}
        groups=admin,sudo,adm append=true
        generate_ssh_key=yes
        shell=/bin/bash

    - name: add unpriv ssh key
      authorized_key: user={{ unpriv_user }} key="{{ lookup('file', unpriv_pubkey_path) }}"

site.yml

---
- name: maria, nginx, php-fpm, sphinxsearch etc.
  hosts: servers
  remote_user: "{{ unpriv_user }}"
  sudo: yes
  tasks:
    - name: Remove vagrant user 
      user: name=vagrant remove=yes state=absent
    - name: change motd
      copy: content='Modified Vagrant precise64 boxer' dest=/etc/motd

Vagrantfile

require 'yaml'
$ansible_vars = YAML.load_file('group_vars/all')

Vagrant.configure("2") do |config|
    config.vm.box = "precise64"
    config.vm.network :public_network

    if ENV['FIRSTRUN'] != 'true'
      config.vm.synced_folder ".", "/home/www"
      config.ssh.username = $ansible_vars['unpriv_user']
      config.ssh.private_key_path = $ansible_vars['unpriv_privkey_path']
    end

    config.vm.provision "ansible" do |ansible|
        ansible.playbook = ENV['FIRSTRUN'] == 'true' ? 'firstrun.yml' : 'site.yml'

        ansible.host_key_checking = false
        ansible.groups = { 
          "servers" => ["default"]
        }
        ansible.verbose = 'vvvv'
    end
end

vars.yml

---
unpriv_user: me
unpriv_privkey_path: '/home/me/.ssh/id_dsa'
unpriv_pubkey_path: '/home/me/.ssh/id_dsa.pub'