23 lines
710 B
Plaintext
23 lines
710 B
Plaintext
# Disable root login entirely
|
|
PermitRootLogin no
|
|
|
|
# Disable password authentication — keys only
|
|
PasswordAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
UsePAM no
|
|
|
|
# Limit authentication attempts
|
|
MaxAuthTries 3
|
|
MaxSessions 2
|
|
|
|
# Allow only your specific user
|
|
AllowUsers deploy
|
|
|
|
# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
|
|
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
|
|
|
# Connection timeout
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2 |