anchor.diff:  # CBC: is true if you want to connect with OpenSSL-base libraries
   # eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
   # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
  -# 
  +#
   <% if @cipher %>
   Ciphers <%= @cipher %>
   <% end %>
   
   # **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
  -# Weak HMAC is sometimes required if older package versions are used 
  +# Weak HMAC is sometimes required if older package versions are used
   # eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
  -# 
  +#
   <% if @mac %>
   MACs <%= @mac %>
   <% end %>
  
positive.code: #ChrootDirectory none
  #ChrootDirectory /home/%u
  
  # Configuratoin, in case SFTP is used
  ## override default of no subsystems
  ## Subsystem sftp /opt/app/openssh5/libexec/sftp-server
  #Subsystem sftp internal-sftp -l VERBOSE
  # 
  ## These lines must appear at the *end* of sshd_config
  #Match Group sftponly
  #ForceCommand internal-sftp -l VERBOSE
  
negative.code: # Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
  StrictModes yes
  
  # Logging, obsoletes QuietMode and FascistLogging
  SyslogFacility AUTH
  LogLevel VERBOSE
  
  