anchor.diff:  # MANAGED BY PUPPET (ssh/templates, via params/hiera)
   # See the sshd_config(5) manpage for details
   
  -# What ports, IPs and protocols we listen for
  -Port <%= options['Port'] || '22' %>
  -# Use these options to restrict which interfaces/protocols sshd will bind to
  +# This is the sshd server system-wide configuration file.  See
  +# sshd_config(5) for more information.
  +
  +# The strategy used for options in the default sshd_config shipped with
  +# OpenSSH is to specify options with their default value where
  +# possible, but leave them commented.  Uncommented options override the
  +# default value.
  +
  +
  +<% if @options['Port'] -%>
  +Port <%= options['Port'] %>
  +<% else -%>
  +#Port 22
  +<% end -%>
  +<% if @options['AddressFamily'] -%>
  +AddressFamily <%= options['AddressFamily'] %>
  +<% else -%>
  +#AddressFamily any
  +<% end -%>
  +#ListenAddress 0.0.0.0
   #ListenAddress ::
  -#ListenAddress 0.0.0.0
   <% if listen_address.respond_to?('each') -%>
   <% listen_address.each do |listener| -%>
   ListenAddress <%= listener %>
  
positive.code: ListenAddress <%= listen_address %>
  <% end -%>
  
  Protocol <%= options['Protocol'] || '2' %>
  # HostKeys for protocol version 2
  HostKey /etc/ssh/ssh_host_rsa_key
  HostKey /etc/ssh/ssh_host_dsa_key
  HostKey /etc/ssh/ssh_host_ecdsa_key
  #Privilege Separation is turned on for security
  UsePrivilegeSeparation <%= options['UsePrivilegeSeparation'] || 'yes' %>
  
  # Lifetime and size of ephemeral version 1 server key
  KeyRegenerationInterval <%= options['KeyRegenerationInterval'] || '3600' %>
  ServerKeyBits <%= options['ServerKeyBits'] || '1024' %>
  
  # <%= options['#'] || 'Logging' %>
  SyslogFacility <%= options['SyslogFacility'] || 'AUTH' %>
  LogLevel <%= options['LogLevel'] || 'INFO' %>
  
  # Authentication:
  LoginGraceTime <%= options['LoginGraceTime'] || '120' %>
  PermitRootLogin <%= permit_root_login %>
  StrictModes <%= options['StrictModes'] || 'yes' %>
  
  RSAAuthentication yes
  PubkeyAuthentication yes
  #AuthorizedKeysFile	%h/.ssh/authorized_keys
  
  # Don't read the user's ~/.rhosts and ~/.shosts files
  IgnoreRhosts <%= options['IgnoreRhosts'] || 'yes' %>
  # For this to work you will also need host keys in /etc/ssh_known_hosts
  RhostsRSAAuthentication <%= options['RhostsRSAAuthentication'] || 'no' %>
  # similar for protocol version 2
  HostbasedAuthentication <%= options['HostbasedAuthentication'] || 'no' %>
  # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
  #IgnoreUserKnownHosts yes
  
  # To enable empty passwords, change to yes (NOT RECOMMENDED)
  PermitEmptyPasswords <%= options['PermitEmptyPasswords'] || 'no' %>
  
  # Change to yes to enable challenge-response passwords (beware issues with
  # some PAM modules and threads)
  ChallengeResponseAuthentication <%= options['ChallengeResponseAuthentication'] || 'no' %>
  
  # Change to no to disable tunnelled clear text passwords
  #PasswordAuthentication yes
  
  # Kerberos options
  #KerberosAuthentication no
  #KerberosGetAFSToken no
  #KerberosOrLocalPasswd yes
  #KerberosTicketCleanup yes
  
  # GSSAPI options
  #GSSAPIAuthentication no
  #GSSAPICleanupCredentials yes
  
  X11Forwarding <%= options['X11Forwarding'] || 'yes' %>
  X11DisplayOffset <%= options['X11DisplayOffset'] || '10' %>
  PrintMotd <%= options['PrintMotd'] || 'no' %>
  PrintLastLog <%= options['PrintLastLog'] || 'yes' %>
  TCPKeepAlive <%= options['TCPKeepAlive'] || 'yes' %>
  #UseLogin no
  
  #MaxStartups 10:30:60
  #Banner /etc/issue.net
  
  # Allow client to pass locale environment variables
  AcceptEnv LANG <%= options['AcceptEnv LANG'] || 'LC_*' %>
  
  <% if @osfamily == 'Debian' -%>
  Subsystem sftp /usr/lib/openssh/sftp-server
  <% elsif @osfamily == 'RedHat' -%>
  Subsystem sftp /usr/libexec/openssh/sftp-server
  <% end -%>
  
  # Set this to 'yes' to enable PAM authentication, account processing,
  
negative.code: # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and ChallengeResponseAuthentication to 'no'.
  <% if @options['UsePAM'] -%>
  UsePAM <%= options['UsePAM'] %>
  <% elsif @osfamily == 'Debian' -%>
  UsePAM yes
  <% elsif @osfamily == 'RedHat' -%>
  UsePAM yes
  <% else -%>
  #UsePAM no
  <% end -%>
  
  
  <% if @options['AllowAgentForwarding'] -%>
  AllowAgentForwarding <%= options['AllowAgentForwarding'] %>
  <% else -%>
  #AllowAgentForwarding yes
  <% end -%>
  <% if @options['AllowTcpForwarding'] -%>
  AllowTcpForwarding <%= options['AllowTcpForwarding'] %>
  <% else -%>
  #AllowTcpForwarding yes
  <% end -%>
  <% if @options['GatewayPorts'] -%>
  GatewayPorts <%= options['GatewayPorts'] %>
  <% else -%>
  #GatewayPorts no
  <% end -%>
  <% if @options['X11Forwarding'] -%>
  X11Forwarding <%= options['X11Forwarding'] %>
  <% else -%>
  #X11Forwarding no
  <% end -%>
  <% if @options['X11DisplayOffset'] -%>
  X11DisplayOffset <%= options['X11DisplayOffset'] %>
  <% else -%>
  #X11DisplayOffset 10
  <% end -%>
  <% if @options['X11UseLocalhost'] -%>
  X11UseLocalhost <%= options['X11UseLocalhost'] %>
  <% else -%>
  #X11UseLocalhost yes
  <% end -%>
  <% if @options['PermitTTY'] -%>
  PermitTTY <%= options['PermitTTY'] %>
  <% else -%>
  #PermitTTY yes
  <% end -%>
  <% if @options['PrintMotd'] -%>
  PrintMotd <%= options['PrintMotd'] %>
  <% else -%>
  #PrintMotd yes
  <% end -%>
  <% if @options['PrintLastLog'] -%>
  PrintLastLog <%= options['PrintLastLog'] %>
  <% else -%>
  #PrintLastLog yes
  <% end -%>
  <% if @options['TCPKeepAlive'] -%>
  TCPKeepAlive <%= options['TCPKeepAlive'] %>
  <% else -%>
  #TCPKeepAlive yes
  <% end -%>
  <% if @options['UseLogin'] -%>
  UseLogin <%= options['UseLogin'] %>
  <% else -%>
  #UseLogin no
  <% end -%>
  <% if @options['UsePrivilegeSeparation'] -%>
  UsePrivilegeSeparation <%= options['UsePrivilegeSeparation'] %>
  <% else -%>
  # If openssh version is >= 6.1 consider using UsePrivilegeSeparation sandbox
  #UsePrivilegeSeparation yes
  <% end -%>
  <% if @options['PermitUserEnvironment'] -%>
  PermitUserEnvironment <%= options['PermitUserEnvironment'] %>
  <% else -%>
  #PermitUserEnvironment no
  <% end -%>
  <% if @options['Compression'] -%>
  Compression <%= options['Compression'] %>
  <% else -%>
  #Compression delayed
  <% end -%>
  <% if @options['ClientAliveInterval'] -%>
  ClientAliveInterval <%= options['ClientAliveInterval'] %>
  <% else -%>
  #ClientAliveInterval 0
  <% end -%>
  <% if @options['ClientAliveCountMax'] -%>
  ClientAliveCountMax <%= options['ClientAliveCountMax'] %>
  <% else -%>
  #ClientAliveCountMax 3
  <% end -%>
  <% if @options['UseDNS'] -%>
  UseDNS <%= options['UseDNS'] %>
  <% else -%>
  #UseDNS yes
  <% end -%>
  <% if @options['PidFile'] -%>
  PidFile <%= options['PidFile'] %>
  <% else -%>
  #PidFile /var/run/sshd.pid
  <% end -%>
  <% if @options['MaxStartups'] -%>
  MaxStartups <%= options['MaxStartups'] %>
  <% else -%>
  #MaxStartups 10:30:100
  <% end -%>
  <% if @options['PermitTunnel'] -%>
  PermitTunnel <%= options['PermitTunnel'] %>
  <% else -%>
  #PermitTunnel no
  <% end -%>
  <% if @options['ChrootDirectory'] -%>
  ChrootDirectory <%= options['ChrootDirectory'] %>
  <% else -%>
  #ChrootDirectory none
  <% end -%>
  <% if @options['VersionAddendum'] -%>
  VersionAddendum <%= options['VersionAddendum'] %>
  <% else -%>
  #VersionAddendum none
  <% end -%>
  
  # no default banner path
  <% if @options['Banner'] -%>
  Banner <%= options['Banner'] %>
  <% else -%>
  #Banner none
  <% end -%>
  
  <% if @osfamily == 'Debian' -%>
  Subsystem sftp /usr/lib/openssh/sftp-server
  <% elsif @osfamily == 'RedHat' -%>
  Subsystem sftp /usr/libexec/openssh/sftp-server
  <% else -%>
  Subsystem	sftp	/usr/libexec/sftp-server
  <% end -%>
  
  