# Purpose: Harden field-device SSH to key-only maintenance access.
# Scope: Applies to the blueforce user; root and password logins stay disabled.
# Safety: Drop-in for sshd_config.d; validate with sshd -t before reload.
# Ref: docs/06-USERS-SSH-AND-PERMISSIONS.md, K-13.

# No direct root login; privilege is gained only via audited sudo.
PermitRootLogin no

# Key-only auth: passwords and interactive challenges are disabled.
PasswordAuthentication no
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# Only the maintenance user may open SSH sessions.
AllowUsers blueforce

# Reduce idle-session and brute-force exposure.
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 60
ClientAliveInterval 300
ClientAliveCountMax 2