# Disable root login entirely
PermitRootLogin no

# Disable password authentication — keys only
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

# Limit authentication attempts
MaxAuthTries 3
MaxSessions 2

# Allow only your specific user
AllowUsers deploy

# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Connection timeout
ClientAliveInterval 300
ClientAliveCountMax 2