# SSH daemon config supplied by TurnKey
# given default config; this overrides default values in /etc/ssh/sshd_config

# permit root ssh login with password
PermitRootLogin yes
# to disable root login using password, change 'yes' to 'prohibit-password'

# disable sshd dns checks (if resolution fails will prevent logins)
UseDNS no

# https://github.com/turnkeylinux/tracker/issues/1092
TCPKeepAlive yes

# SSH hardening recommended by lynis
X11Forwarding no
AllowTcpForwarding no
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 2

# configure root login banner directive (enabled by inithooks#sudoadmin)
Match user root
Banner /root/.ssh/banner
Match user *
