{{ ansible_managed | comment }}

# sshd configuration for perfact systems allowing perfact-useradmin

# Managed by Ansible   ---   Do not modify manually!
# generated from custom file
# ./internalit/roles/perfact-file/templates/sshd_config/90-custom.conf

# do not trust ~/.ssh/known_hosts for HostbasedAuthentication
IgnoreUserKnownHosts yes

# disable sftp
#Subsystem       sftp    /bin/none

# force key authentification
ChallengeResponseAuthentication no
PasswordAuthentication no

# perfactusers need to login with password
Match Group perfactusers
PasswordAuthentication yes
Match All


# no X11
X11Forwarding no

# Allow user only:
# special group 'perfactusers' for perfact-file-*
AllowGroups perfact root perfactusers

# ALLOW ssh from pf-backup (BackupPC) and phonehome-user pfremote
Match host 192.168.42.100
  PermitRootLogin without-password
  AllowUsers root
Match All
