# New-host baseline. Install only after key login and sudo work.
# The actual main sshd config must include this file at global scope.
# Check first-value precedence and verify sshd -T before reloading.
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
GSSAPIAuthentication no
HostbasedAuthentication no
UsePAM yes
AuthenticationMethods publickey
PermitEmptyPasswords no
PermitUserEnvironment no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no

# Optional MFA belongs in a later Match block in the main configuration.
# See docs/ssh.md. Leave the distribution's subsystem configuration in place.