# SSH Server Configuration
Port 2222
Protocol 2
ListenAddress 0.0.0.0
ListenAddress ::
ListenAddress 192.168.1.100:22

# Authentication
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
MaxAuthTries 3
MaxSessions 5

# Login settings
LoginGraceTime 30s
ClientAliveInterval 300
ClientAliveCountMax 2

# Networking
UseDNS no
X11Forwarding no

# Crypto
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

# Host keys
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key

# Logging
SyslogFacility AUTHPRIV
LogLevel VERBOSE

# Access control
AllowUsers admin operator@192.168.1.* backup@10.0.0.*
DenyUsers root git daemon
AllowGroups ssh-users wheel
DenyGroups temp-users

# SFTP subsystem
Subsystem sftp /usr/lib/openssh/sftp-server

# Banner
Banner /etc/ssh/banner.txt

# Match blocks
Match Group sftp-only
    ForceCommand internal-sftp
    ChrootDirectory /sftp/%u
    PermitTunnel no
    AllowAgentForwarding no
    AllowTcpForwarding no

Match User admin
    PermitRootLogin no
    MaxSessions 10
    ClientAliveInterval 60

Match Host 10.0.0.*
    PasswordAuthentication yes
    PermitRootLogin forced-commands-only
    GatewayPorts yes