# Managed by Ansible - ssh_harden role.
# Sorted last (99-) so this wins over other drop-ins and the main config.

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
UseDNS no
X11Forwarding no
PrintMotd no
MaxAuthTries {{ ssh_max_auth_tries }}
MaxSessions 4
LoginGraceTime 30
ClientAliveInterval {{ ssh_client_alive_interval }}
ClientAliveCountMax {{ ssh_client_alive_count_max }}
{% if ssh_port != 22 %}Port {{ ssh_port }}{% endif %}
{% if ssh_restrict_users %}AllowUsers {{ admin_user }}{% endif %}