| Argument | Type | Description |
|---|
| ciphers | multi { array-id, cipher: enum (aes-gcm | aes-ctr | aes-cbc | 3des-cbc | null | auto)
} | Allowed cipher list. |
| forwarding-enabled | enum (no | local | remote | both) | Control which SSH forwarding method to allow: no - SSH forwarding is disabled, local - allow SSH clients to originate connections from the server (router), this also controls dynamic forwarding, remote - allow SSH clients to listen on the server (router) and forward incoming connections, both - allow both local and remote forwarding methods. |
| password-authentication | enum (yes | no | yes-if-no-key) | Whether to allow password login when public key authorization is configured for a user. |
| publickey-authentication-options | enum (none | touch-required | verify-required) | Public key authentication options. The touch-required option causes public key authentication by using a FIDO authenticator algorithm to always require the signature to attest that a physically present user explicitly confirmed the authentication (usually by touching the authenticator). The verify-required option requires a FIDO key signature to attest that the user was verified, for example, by using a PIN. |
| strong-crypto | bool | Use stronger encryption, HMAC algorithms, use bigger DH primes and disallow weaker ones: use 256 and 192 bit encryption instead of 128 bits, disable null encryption, use sha256 for hashing instead of sha1, disable md5, use 2048bit prime for Diffie-Hellman exchange instead of 1024bit. |
| host-key-size | enum (1024 | 1536 | 2048 | 4096 | 8192) { 1024:1024, 1536:1536, 2048:2048, 4096:4096, 8192:8192 } | RSA key size when host key is regenerated. |
| host-key-type | enum (rsa | ed25519) { rsa:0, ed25519:3 } | Host key type. |