Port {{ ssh_port }}
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

# Authentication
PermitRootLogin {{ ssh_permit_root_login }}
PasswordAuthentication {{ ssh_password_authentication }}
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no
UsePAM yes
MaxAuthTries {{ ssh_max_auth_tries }}
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# Disable unused auth methods
GSSAPIAuthentication no
KerberosAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no

# Session
X11Forwarding no
PrintMotd no
TCPKeepAlive yes
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 30

# Restrict users
AllowUsers {{ ssh_allowed_users }}

# Logging
LogLevel VERBOSE
SyslogFacility AUTH

# SFTP
Subsystem sftp /usr/lib/openssh/sftp-server