{ ... }:
{
  services.openssh.enable = true;
  services.openssh.settings = {
    PermitRootLogin = "no";
    PasswordAuthentication = false;
    KbdInteractiveAuthentication = false;
    AllowTcpForwarding = "no";
    X11Forwarding = false;
    UseDns = false;
    MaxAuthTries = 3;
  };
}