anchor.diff:  ListenAddress <%= listen_address %>
   <% end -%>
   
  +# The default requires explicit activation of protocol 1 starting
  +# with openssh-5.4.
  +# Defaulting to protocol 2 unless otherwise specified
  +# regardless of openssh version.
   Protocol <%= options['Protocol'] || '2' %>
  +
  +<% if @options['HostKey'] -%>
  +<% if options['HostKey'].respond_to?('each') -%>
  +<% options['HostKey'].each do |hostkey_pathname| -%>
  +HostKey <%= hostkey_pathname %>
  +<% end -%>
  +<% else -%>
  +HostKey <%= options['HostKey'] %>
  +<% end -%>
  +<% else -%>
  +# HostKey for protocol version 1
  +#HostKey /etc/ssh/ssh_host_key
   # HostKeys for protocol version 2
  -HostKey /etc/ssh/ssh_host_rsa_key
  -HostKey /etc/ssh/ssh_host_dsa_key
  -HostKey /etc/ssh/ssh_host_ecdsa_key
  -#Privilege Separation is turned on for security
  -UsePrivilegeSeparation <%= options['UsePrivilegeSeparation'] || 'yes' %>
  +#HostKey /etc/ssh/ssh_host_rsa_key
  +#HostKey /etc/ssh/ssh_host_dsa_key
  +#HostKey /etc/ssh/ssh_host_ecdsa_key
  +#HostKey /etc/ssh/ssh_host_ed25519_key
  +<% end -%>
   
   # Lifetime and size of ephemeral version 1 server key
  -KeyRegenerationInterval <%= options['KeyRegenerationInterval'] || '3600' %>
  +# Unless specified, setting ServerKeyBits to newer default of 1024
  +<% if @options['KeyRegenerationInterval'] -%>
  +KeyRegenerationInterval <%= options['KeyRegenerationInterval'] %>
  +<% else -%>
  +#KeyRegenerationInterval 1h
  +<% end -%>
   ServerKeyBits <%= options['ServerKeyBits'] || '1024' %>
   
  -# <%= options['#'] || 'Logging' %>
  -SyslogFacility <%= options['SyslogFacility'] || 'AUTH' %>
  -LogLevel <%= options['LogLevel'] || 'INFO' %>
  +# Ciphers and keying
  +#RekeyLimit default none
  +
  +# Logging
  +# obsoletes QuietMode and FascistLogging
  +<% if @options['SyslogFacility'] -%>
  +SyslogFacility <%= options['SyslogFacility'] %>
  +<% elsif @osfamily == 'RedHat' -%>
  +SyslogFacility <%= options['SyslogFacility'] || 'AUTHPRIV' %>
  +<% else -%>
  +#SyslogFacility AUTH
  +<% end -%>
  +<% if @options['LogLevel'] -%>
  +LogLevel <%= options['LogLevel'] %>
  +<% else -%>
  +#LogLevel INFO
  +<% end -%>
   
   # Authentication:
  -LoginGraceTime <%= options['LoginGraceTime'] || '120' %>
  +
  +<% if @options['LoginGraceTime'] -%>
  +LoginGraceTime <%= options['LoginGraceTime'] %>
  +<% else -%>
  +#LoginGraceTime 2m
  +<% end -%>
   PermitRootLogin <%= permit_root_login %>
  -StrictModes <%= options['StrictModes'] || 'yes' %>
  -
  -RSAAuthentication yes
  -PubkeyAuthentication yes
  -#AuthorizedKeysFile	%h/.ssh/authorized_keys
  -
  +<% if @options['StrictModes'] -%>
  +StrictModes <%= options['StrictModes'] %>
  +<% else -%>
  +#StrictModes yes
  +<% end -%>
  +<% if @options['MaxAuthTries'] -%>
  +MaxAuthTries <%= options['MaxAuthTries'] %>
  +<% else -%>
  +#MaxAuthTries 6
  +<% end -%>
  +<% if @options['MaxSessions'] -%>
  +MaxSessions <%= options['MaxSessions'] %>
  +<% else -%>
  +#MaxSessions 10
  +<% end -%>
  +
  +<% if @options['RSAAuthentication'] -%>
  +RSAAuthentication <%= options['RSAAuthentication'] %>
  +<% else -%>
  +#RSAAuthentication yes
  +<% end -%>
  +<% if @options['PubkeyAuthentication'] -%>
  +PubkeyAuthentication <%= options['PubkeyAuthentication'] %>
  +<% else -%>
  +#PubkeyAuthentication yes
  +<% end -%>
  +
  +<% if @options['AuthorizedKeysFile'] -%>
  +AuthorizedKeysFile <%= options['AuthorizedKeysFile'] %>
  +<% else -%>
  +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
  +# but this is overridden so installations will only check .ssh/authorized_keys
  +AuthorizedKeysFile	.ssh/authorized_keys
  +<% end -%>
  +
  +<% if @options['AuthorizedPrincipalsFile'] -%>
  +AuthorizedPrincipalsFile <%= options['AuthorizedPrincipalsFile'] %>
  +<% else -%>
  +#AuthorizedPrincipalsFile none
  +<% end -%>
  +
  +<% if @options['AuthorizedKeysCommand'] -%>
  +AuthorizedKeysCommand <%= options['AuthorizedKeysCommand'] %>
  +<% else -%>
  +#AuthorizedKeysCommand none
  +<% end -%>
  +<% if @options['AuthorizedKeysCommandUser'] -%>
  +AuthorizedKeysCommandUser <%= options['AuthorizedKeysCommandUser'] %>
  +<% else -%>
  +#AuthorizedKeysCommandUser nobody
  +<% end -%>
  +
  +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  +<% if @options['RhostsRSAAuthentication'] -%>
  +RhostsRSAAuthentication <%= options['RhostsRSAAuthentication'] %>
  +<% else -%>
  +#RhostsRSAAuthentication no
  +<% end -%>
  +# similar for protocol version 2
  +<% if @options['HostbasedAuthentication'] -%>
  +HostbasedAuthentication <%= options['HostbasedAuthentication'] %>
  +<% else -%>
  +#HostbasedAuthentication no
  +<% end -%>
  +# Change to yes if you don't trust ~/.ssh/known_hosts for
  +# RhostsRSAAuthentication and HostbasedAuthentication
  +<% if @options['IgnoreUserKnownHosts'] -%>
  +IgnoreUserKnownHosts <%= options['IgnoreUserKnownHosts'] %>
  +<% else -%>
  +#IgnoreUserKnownHosts no
  +<% end -%>
   # Don't read the user's ~/.rhosts and ~/.shosts files
  -IgnoreRhosts <%= options['IgnoreRhosts'] || 'yes' %>
  -# For this to work you will also need host keys in /etc/ssh_known_hosts
  -RhostsRSAAuthentication <%= options['RhostsRSAAuthentication'] || 'no' %>
  -# similar for protocol version 2
  -HostbasedAuthentication <%= options['HostbasedAuthentication'] || 'no' %>
  -# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
  -#IgnoreUserKnownHosts yes
  -
  -# To enable empty passwords, change to yes (NOT RECOMMENDED)
  -PermitEmptyPasswords <%= options['PermitEmptyPasswords'] || 'no' %>
  -
  -# Change to yes to enable challenge-response passwords (beware issues with
  -# some PAM modules and threads)
  -ChallengeResponseAuthentication <%= options['ChallengeResponseAuthentication'] || 'no' %>
  -
  -# Change to no to disable tunnelled clear text passwords
  +<% if @options['IgnoreRhosts'] -%>
  +IgnoreRhosts <%= options['IgnoreRhosts'] %>
  +<% else -%>
  +#IgnoreRhosts yes
  +<% end -%>
  +
  +# To disable tunneled clear text passwords, change to no here!
  +<% if @options['PasswordAuthentication'] -%>
  +PasswordAuthentication <%= options['PasswordAuthentication'] %>
  +<% else -%>
   #PasswordAuthentication yes
  +<% end -%>
  +<% if @options['PermitEmptyPasswords'] -%>
  +PermitEmptyPasswords <%= options['PermitEmptyPasswords'] %>
  +<% else -%>
  +#PermitEmptyPasswords no
  +<% end -%>
  +
  +# Change to no to disable s/key passwords
  +<% if @options['ChallengeResponseAuthentication'] -%>
  +ChallengeResponseAuthentication <%= options['ChallengeResponseAuthentication'] %>
  +<% else -%>
  +#ChallengeResponseAuthentication yes
  +<% end -%>
   
   # Kerberos options
  +<% if @options['KerberosAuthentication'] -%>
  +KerberosAuthentication <%= options['KerberosAuthentication'] %>
  +<% else -%>
   #KerberosAuthentication no
  +<% end -%>
  +<% if @options['KerberosOrLocalPasswd'] -%>
  +KerberosOrLocalPasswd <%= options['KerberosOrLocalPasswd'] %>
  +<% else -%>
  +#KerberosOrLocalPasswd yes
  +<% end -%>
  +<% if @options['KerberosTicketCleanup'] -%>
  +KerberosTicketCleanup <%= options['KerberosTicketCleanup'] %>
  +<% else -%>
  +#KerberosTicketCleanup yes
  +<% end -%>
  +<% if @options['KerberosGetAFSToken'] -%>
  +KerberosGetAFSToken <%= options['KerberosGetAFSToken'] %>
  +<% else -%>
   #KerberosGetAFSToken no
  -#KerberosOrLocalPasswd yes
  -#KerberosTicketCleanup yes
  +<% end -%>
   
   # GSSAPI options
  +<% if @options['GSSAPIAuthentication'] -%>
  +GSSAPIAuthentication <%= options['GSSAPIAuthentication'] %>
  +<% else -%>
   #GSSAPIAuthentication no
  +<% end -%>
  +<% if @options['GSSAPICleanupCredentials'] -%>
  +GSSAPICleanupCredentials <%= options['GSSAPICleanupCredentials'] %>
  +<% else -%>
   #GSSAPICleanupCredentials yes
  -
  -X11Forwarding <%= options['X11Forwarding'] || 'yes' %>
  -X11DisplayOffset <%= options['X11DisplayOffset'] || '10' %>
  -PrintMotd <%= options['PrintMotd'] || 'no' %>
  -PrintLastLog <%= options['PrintLastLog'] || 'yes' %>
  -TCPKeepAlive <%= options['TCPKeepAlive'] || 'yes' %>
  -#UseLogin no
  -
  -#MaxStartups 10:30:60
  -#Banner /etc/issue.net
  -
  -# Allow client to pass locale environment variables
  -AcceptEnv LANG <%= options['AcceptEnv LANG'] || 'LC_*' %>
  -
  -<% if @osfamily == 'Debian' -%>
  -Subsystem sftp /usr/lib/openssh/sftp-server
  -<% elsif @osfamily == 'RedHat' -%>
  -Subsystem sftp /usr/libexec/openssh/sftp-server
   <% end -%>
   
   # Set this to 'yes' to enable PAM authentication, account processing,
  
positive.code: # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and ChallengeResponseAuthentication to 'no'.
  UsePAM <%= options['UsePAM'] || 'yes' %>
  
negative.code: # MANAGED BY PUPPET (ssh/templates, via params/hiera)
  # See the sshd_config(5) manpage for details
  
  # This is the sshd server system-wide configuration file.  See
  # sshd_config(5) for more information.
  
  # The strategy used for options in the default sshd_config shipped with
  # OpenSSH is to specify options with their default value where
  # possible, but leave them commented.  Uncommented options override the
  # default value.
  
  
  <% if @options['Port'] -%>
  Port <%= options['Port'] %>
  <% else -%>
  #Port 22
  <% end -%>
  <% if @options['AddressFamily'] -%>
  AddressFamily <%= options['AddressFamily'] %>
  <% else -%>
  #AddressFamily any
  <% end -%>
  #ListenAddress 0.0.0.0
  #ListenAddress ::
  <% if listen_address.respond_to?('each') -%>
  <% listen_address.each do |listener| -%>
  ListenAddress <%= listener %>
  