# heleos SSH hardening — managed by Ansible. Do not edit by hand.

PermitRootLogin prohibit-password
PubkeyAuthentication yes
PasswordAuthentication {{ 'no' if ssh_disable_password_auth else 'yes' }}
KbdInteractiveAuthentication no
X11Forwarding no
AllowAgentForwarding no
MaxAuthTries 4
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2

# SFTP-only tenant accounts (created per customer in Phase 4). ChrootDirectory
# is set per user at provision time; this block enforces the shared restrictions.
Match Group sftponly
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no
    PermitTunnel no
    PermitTTY no