PubkeyAuthentication yes
AuthorizedKeysFile	.ssh/authorized_keys
PasswordAuthentication no
KbdInteractiveAuthentication no
UsePAM yes
# Disable password authentication — keys only
PasswordAuthentication no
ChallengeResponseAuthentication no


AllowGroups sshusers
PrintMotd no
AcceptEnv LANG LC_*
ClientAliveCountMax 0
ClientAliveInterval 300
Port 22


# Disable root login entirely
PermitRootLogin no

# Limit authentication attempts
MaxAuthTries 3
MaxSessions 3

# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com