# TLO hardening SSH — 2026-06-25  (/etc/ssh/sshd_config.d/99-tlo-hardening.conf)
X11Forwarding no
AllowTcpForwarding no
MaxAuthTries 3
LoginGraceTime 30
MaxSessions 4
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers root ubuntu
PermitRootLogin prohibit-password

# Algos modernes uniquement (retrait hmac-sha1, umac-64, aes-ctr)
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512