anchor.diff:  # Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
   StrictModes yes
   
  -# Logging, obsoletes QuietMode and FascistLogging 
  +# Logging, obsoletes QuietMode and FascistLogging
   SyslogFacility AUTH
   LogLevel VERBOSE
   
  
positive.code: # CBC: is true if you want to connect with OpenSSL-base libraries
  # eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
  # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
  # 
  <% if @cipher %>
  Ciphers <%= @cipher %>
  <% end %>
  
  # **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
  # Weak HMAC is sometimes required if older package versions are used 
  # eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
  # 
  <% if @mac %>
  MACs <%= @mac %>
  <% end %>
  
negative.code: #ChrootDirectory none
  #ChrootDirectory /home/%u
  
  # Configuration, in case SFTP is used
  ## override default of no subsystems
  ## Subsystem sftp /opt/app/openssh5/libexec/sftp-server
  #Subsystem sftp internal-sftp -l VERBOSE
  #
  ## These lines must appear at the *end* of sshd_config
  #Match Group sftponly
  #ForceCommand internal-sftp -l VERBOSE
  