# NO ROOT
PermitRootLogin no

# git user has access to all repos. no login allowed
DenyUsers git

# no login shell
PermitTTY no

# Force run script that checks for permissions and runs sudo
ForceCommand /usr/local/bin/git-run "$SSH_ORIGINAL_COMMAND"

# Only public key login is allowed
# no password brute force
PubkeyAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no

# no forwarding and tunneling
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no

# Limit authentication tries per connection
MaxAuthTries 3

# Do not wait too long for authentication
LoginGraceTime 10

# Point keys to shared data dir to avoid regenerating them each time
HostKey /var/ssh/etc/ssh/ssh_host_rsa_key
HostKey /var/ssh/etc/ssh/ssh_host_ecdsa_key
HostKey /var/ssh/etc/ssh/ssh_host_ed25519_key

# Logging
SyslogFacility AUTH
LogLevel INFO