# {{ ansible_managed }}
# SSH hardening drop-in managed by the linux-baseline Ansible role.
# Distro defaults live in /etc/ssh/sshd_config; this file overrides them.

PermitRootLogin {{ linux_baseline_ssh_permit_root_login }}
PasswordAuthentication {{ 'yes' if linux_baseline_ssh_password_authentication else 'no' }}
KbdInteractiveAuthentication {{ 'yes' if linux_baseline_ssh_kbd_interactive_authentication else 'no' }}
X11Forwarding {{ 'yes' if linux_baseline_ssh_x11_forwarding else 'no' }}
MaxAuthTries {{ linux_baseline_ssh_max_auth_tries }}
LoginGraceTime {{ linux_baseline_ssh_login_grace_time }}
ClientAliveInterval {{ linux_baseline_ssh_client_alive_interval }}
ClientAliveCountMax {{ linux_baseline_ssh_client_alive_count_max }}
{% if linux_baseline_ssh_allow_users | length > 0 %}
AllowUsers {{ linux_baseline_ssh_allow_users | join(' ') }}
{% endif %}
{% if linux_baseline_ssh_allow_groups | length > 0 %}
AllowGroups {{ linux_baseline_ssh_allow_groups | join(' ') }}
{% endif %}