# Managed by Ansible
Port {{ ssh_port }}
Protocol 2

PermitRootLogin {{ permit_root_login }}
PasswordAuthentication {{ "no" if disable_password_auth else "yes" }}
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

PubkeyAuthentication yes
AuthenticationMethods publickey

Subsystem sftp /usr/lib/openssh/sftp-server

X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
PermitUserEnvironment no

ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 30
MaxAuthTries 3
MaxSessions 4

LogLevel VERBOSE

{% if ssh_allow_users is defined and ssh_allow_users|length > 0 %}
AllowUsers {% for u in ssh_allow_users %}{{ u }} {% endfor %}
{% endif %}