sshd_config

# Listen on all addresses
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

# Use volume mapped hostkeys directory
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
HostKey /etc/ssh/hostkeys.d/ssh_host_ed25519_key
HostKey /etc/ssh/hostkeys.d/ssh_host_rsa-sha2-256_key
HostKey /etc/ssh/hostkeys.d/ssh_host_rsa-sha2-512_key

# Use safer types
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com

# Use authorized key manger (akm) to manage key-based auth
AuthorizedKeysCommand /etc/ssh/auth.sh
AuthorizedKeysCommandUser nobody
AuthorizedKeysFile none

# Lockdown the jumpbox a little
ForceCommand /sbin/nologin
GatewayPorts no
PermitTTY no
PermitTunnel no
X11Forwarding no
PasswordAuthentication no
PermitEmptyPasswords no
LoginGraceTime 30

# Other qualty-of-life options
ClientAliveCountMax 20
ClientAliveInterval 30
PrintMotd no
Banner /etc/ssh/banner

# Use Syslog
SyslogFacility  AUTH