# Arcline OS — ssh hardening
# Secure by default: key-based auth only, root login via key only.
# To allow password auth, comment the PasswordAuthentication line — you opt
# in to exposure, never out.
#
# Matches Debian's drop-in semantics (Read drop-ins from sshd_config.d).

# authentication
PermitRootLogin prohibit-password
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitEmptyPasswords no
MaxAuthTries 3
LoginGraceTime 30

# session hardening
X11Forwarding no
AllowTcpForwarding yes
AllowAgentForwarding yes
ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive no
UseDNS no