1Port 22
 2AddressFamily any
 3ListenAddress 0.0.0.0
 4ListenAddress ::
 5
 6PermitRootLogin no
 7
 8LoginGraceTime 30s
 9MaxAuthTries 3
10MaxSessions 10
11
12# STRICTLY Key-based authentication only
13PubkeyAuthentication yes
14AuthorizedKeysFile .ssh/authorized_keys
15
16# Disable all password-based authentication
17PasswordAuthentication no
18PermitEmptyPasswords no
19
20# Disable ChallengeResponse/KeyboardInteractive (often used for PAM passwords)
21KbdInteractiveAuthentication no
22
23# Check file permissions on user's home directory and .ssh folder
24StrictModes yes
25
26# Disable GSSAPI/Kerberos to speed up connection time (unless you use it specifically)
27GSSAPIAuthentication no
28GSSAPICleanupCredentials yes
29
30# Disable PAM unless you are using it for MFA (Google Auth, etc). 
31# If strictly using keys, 'no' is cleaner, but 'yes' is standard for session processing.
32UsePAM yes
33
34# Disable features that can be used by attackers to pivot through your server
35# Enable these only if you specifically need them.
36AllowAgentForwarding no
37AllowTcpForwarding no
38GatewayPorts no
39X11Forwarding no
40PermitTunnel no
41PermitUserEnvironment no
42
43# --- Logging & Monitoring ---
44SyslogFacility AUTH
45LogLevel VERBOSE
46
47# --- Keep Alive & Timeouts ---
48# Send a check to the client every 300 seconds (5 mins)
49ClientAliveInterval 300
50# Disconnect if client doesn't respond 3 times (Total 15 mins idle protection)
51ClientAliveCountMax 3
52
53# --- Subsystems ---
54# Secure File Transfer (SFTP)
55Subsystem sftp /usr/lib/ssh/sftp-server