# Managed by Ansible role linux_ssh_hardening_rhel9
# CIS-aligned SSH server hardening

PermitRootLogin {{ linux_ssh_permit_root_login }}
PasswordAuthentication {{ linux_ssh_password_auth }}
PermitEmptyPasswords {{ linux_ssh_permit_empty_passwords }}
X11Forwarding {{ linux_ssh_x11_forwarding }}
AllowTcpForwarding {{ linux_ssh_allow_tcp_forwarding }}

Ciphers {{ linux_ssh_ciphers }}
MACs {{ linux_ssh_macs }}
KexAlgorithms {{ linux_ssh_kexalgorithms }}

MaxAuthTries {{ linux_ssh_max_auth_tries }}
MaxSessions {{ linux_ssh_max_sessions }}
MaxStartups {{ linux_ssh_max_startups }}

Banner {{ linux_ssh_banner }}

Subsystem sftp {{ linux_ssh_subsystem }}

# Additional security
LoginGraceTime {{ linux_ssh_login_grace_time }}
ClientAliveInterval {{ linux_ssh_client_alive_interval }}
ClientAliveCountMax {{ linux_ssh_client_alive_count_max }}
IgnoreRhosts yes
PermitUserEnvironment no