# Ansible managed
AcceptEnv LANG LC_*
AllowAgentForwarding no
AllowGroups provision users
AllowTcpForwarding yes
AuthenticationMethods any
Banner __PROGRAMDATA__/ssh/issue.net
ChallengeResponseAuthentication no
Ciphers {{ __ssh_ciphers__ | join(',') }}
ClientAliveCountMax 1
ClientAliveInterval 200
Compression no
GSSAPIAuthentication no
HostbasedAuthentication no
HostKeyAlgorithms {{ __ssh_hostkey_algorithms__ | join(',') }}
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAcceptedAlgorithms {{ __ssh_pubkey_accepted_algorithms__ | join(',') }}
IgnoreUserKnownHosts yes
{% set __ssh_supported_kex__ = ssh_supported_kex.stdout_lines | default([]) | map('trim') | reject('equalto', '') | list %}
{% set __ssh_effective_kex__ = (__ssh_kex_algorithms__ | intersect(__ssh_supported_kex__)) if (__ssh_supported_kex__ | length > 0) else __ssh_kex_algorithms__ %}
{% if __ssh_effective_kex__ | length > 0 %}
KexAlgorithms {{ __ssh_effective_kex__ | join(',') }}
{% endif %}
LoginGraceTime 20
LogLevel VERBOSE
Macs {{ __ssh_macs__ | join(',') }}
MaxAuthTries {{ __ssh_max_auth_tries__ }}
MaxSessions {{ __ssh_max_sessions__ }}
MaxStartups 10:30:60
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin no
PermitUserEnvironment no
Port 22
PrintLastLog yes
PrintMotd no
RekeyLimit 512M 1h
RequiredRSASize 2048
StrictModes yes
TCPKeepAlive no
UseDNS no
X11Forwarding no
Subsystem sftp internal-sftp
{% if __ssh_subsystem_path__ | default('') | length > 0 %}
Subsystem powershell "{{ __ssh_subsystem_path__ }}" -sshs -NoLogo -NoProfile
{% endif %}
Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys