Include /etc/ssh/sshd_config.d/*.conf

Port {{ ssh_port }}

# Protocol 2 is now the only protocol and doesn't need to be specified

# UsePrivilegeSeparation was removed in OpenSSH 7.5 (always enabled now)
PermitRootLogin no                        # Disable direct root login via SSH (use your admin user then sudo)
StrictModes yes                           # Enable strict permissions checking for user home directories and key files
MaxAuthTries {{ ssh_max_auth_tries }}     # Maximum authentication attempts per connection
MaxSessions {{ ssh_max_sessions }}        # Maximum open sessions per network connection
LoginGraceTime {{ ssh_login_grace_time }} # Time allowed for authentication
AllowGroups sshusers                      # Only allow users in sshusers group
LogLevel {{ ssh_log_level }}              # Enhanced logging for security monitoring
Banner /etc/issue.net                     # Display login banner

PubkeyAuthentication yes                # Enable public key authentication
AuthorizedKeysFile .ssh/authorized_keys # Default location for authorized keys

# Disable password and keyboard-interactive authentication (rely solely on keys)
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no

# Host-based authentication (less common for client-server)
HostbasedAuthentication no
IgnoreRhosts yes

# PAM (Pluggable Authentication Modules)
UsePAM yes

# Forwarding and other features
X11Forwarding yes                                    # Enable X11 forwarding
PrintMotd no                                         # Disable printing the Message of the Day
PrintLastLog yes                                     # Print last login time and date
TCPKeepAlive yes                                     # Send TCP keepalives
ClientAliveInterval {{ ssh_client_alive_interval }}  # Disconnect idle clients
ClientAliveCountMax {{ ssh_client_alive_count_max }} # Max client alive messages before disconnecting

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# AllowUsers replaced by AllowGroups sshusers for better group management
