anchor.diff:  # PAM authentication, then enable this but set PasswordAuthentication
   # and ChallengeResponseAuthentication to 'no'.
   <% if @options['UsePAM'] -%>
  -UsePAM <%= options['UsePAM'] %>
  +UsePAM <%= @options['UsePAM'] %>
   <% elsif @osfamily == 'Debian' -%>
   UsePAM yes
   <% elsif @osfamily == 'RedHat' -%>
  
positive.code: <% end -%>
  
  <% if @options['AuthorizedPrincipalsFile'] -%>
  AuthorizedPrincipalsFile <%= options['AuthorizedPrincipalsFile'] %>
  <% else -%>
  #AuthorizedPrincipalsFile none
  <% end -%>
  
  <% if @options['AuthorizedKeysCommand'] -%>
  AuthorizedKeysCommand <%= options['AuthorizedKeysCommand'] %>
  <% else -%>
  #AuthorizedKeysCommand none
  <% end -%>
  <% if @options['AuthorizedKeysCommandUser'] -%>
  AuthorizedKeysCommandUser <%= options['AuthorizedKeysCommandUser'] %>
  <% else -%>
  #AuthorizedKeysCommandUser nobody
  <% end -%>
  
  # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  <% if @options['RhostsRSAAuthentication'] -%>
  RhostsRSAAuthentication <%= options['RhostsRSAAuthentication'] %>
  <% else -%>
  #RhostsRSAAuthentication no
  <% end -%>
  # similar for protocol version 2
  <% if @options['HostbasedAuthentication'] -%>
  HostbasedAuthentication <%= options['HostbasedAuthentication'] %>
  <% else -%>
  #HostbasedAuthentication no
  <% end -%>
  # Change to yes if you don't trust ~/.ssh/known_hosts for
  # RhostsRSAAuthentication and HostbasedAuthentication
  <% if @options['IgnoreUserKnownHosts'] -%>
  IgnoreUserKnownHosts <%= options['IgnoreUserKnownHosts'] %>
  <% else -%>
  #IgnoreUserKnownHosts no
  <% end -%>
  # Don't read the user's ~/.rhosts and ~/.shosts files
  <% if @options['IgnoreRhosts'] -%>
  IgnoreRhosts <%= options['IgnoreRhosts'] %>
  <% else -%>
  #IgnoreRhosts yes
  <% end -%>
  
  # To disable tunneled clear text passwords, change to no here!
  <% if @options['PasswordAuthentication'] -%>
  PasswordAuthentication <%= options['PasswordAuthentication'] %>
  <% else -%>
  #PasswordAuthentication yes
  <% end -%>
  <% if @options['PermitEmptyPasswords'] -%>
  PermitEmptyPasswords <%= options['PermitEmptyPasswords'] %>
  <% else -%>
  #PermitEmptyPasswords no
  <% end -%>
  
  # Change to no to disable s/key passwords
  <% if @options['ChallengeResponseAuthentication'] -%>
  ChallengeResponseAuthentication <%= options['ChallengeResponseAuthentication'] %>
  <% else -%>
  #ChallengeResponseAuthentication yes
  <% end -%>
  
  # Kerberos options
  <% if @options['KerberosAuthentication'] -%>
  KerberosAuthentication <%= options['KerberosAuthentication'] %>
  <% else -%>
  #KerberosAuthentication no
  <% end -%>
  <% if @options['KerberosOrLocalPasswd'] -%>
  KerberosOrLocalPasswd <%= options['KerberosOrLocalPasswd'] %>
  <% else -%>
  #KerberosOrLocalPasswd yes
  <% end -%>
  <% if @options['KerberosTicketCleanup'] -%>
  KerberosTicketCleanup <%= options['KerberosTicketCleanup'] %>
  <% else -%>
  #KerberosTicketCleanup yes
  <% end -%>
  <% if @options['KerberosGetAFSToken'] -%>
  KerberosGetAFSToken <%= options['KerberosGetAFSToken'] %>
  <% else -%>
  #KerberosGetAFSToken no
  <% end -%>
  
  # GSSAPI options
  <% if @options['GSSAPIAuthentication'] -%>
  GSSAPIAuthentication <%= options['GSSAPIAuthentication'] %>
  <% else -%>
  #GSSAPIAuthentication no
  <% end -%>
  <% if @options['GSSAPICleanupCredentials'] -%>
  GSSAPICleanupCredentials <%= options['GSSAPICleanupCredentials'] %>
  <% else -%>
  #GSSAPICleanupCredentials yes
  <% end -%>
  
negative.code: #X11Forwarding no
  <% end -%>
  <% if @options['X11DisplayOffset'] -%>
  X11DisplayOffset <%= @options['X11DisplayOffset'] %>
  <% else -%>
  #X11DisplayOffset 10
  <% end -%>
  <% if @options['X11UseLocalhost'] -%>
  X11UseLocalhost <%= @options['X11UseLocalhost'] %>
  <% else -%>
  #X11UseLocalhost yes
  <% end -%>
  <% if @options['PermitTTY'] -%>
  PermitTTY <%= @options['PermitTTY'] %>
  <% else -%>
  #PermitTTY yes
  <% end -%>
  <% if @options['PrintMotd'] -%>
  PrintMotd <%= @options['PrintMotd'] %>
  <% else -%>
  #PrintMotd yes
  <% end -%>
  <% if @options['PrintLastLog'] -%>
  PrintLastLog <%= @options['PrintLastLog'] %>
  <% else -%>
  #PrintLastLog yes
  <% end -%>
  <% if @options['TCPKeepAlive'] -%>
  TCPKeepAlive <%= @options['TCPKeepAlive'] %>
  <% else -%>
  #TCPKeepAlive yes
  <% end -%>
  <% if @options['UseLogin'] -%>
  UseLogin <%= @options['UseLogin'] %>
  <% else -%>
  #UseLogin no
  <% end -%>
  <% if @options['UsePrivilegeSeparation'] -%>
  UsePrivilegeSeparation <%= @options['UsePrivilegeSeparation'] %>
  <% else -%>
  # If openssh version is >= 6.1 consider using UsePrivilegeSeparation sandbox
  #UsePrivilegeSeparation yes
  <% end -%>
  <% if @options['PermitUserEnvironment'] -%>
  PermitUserEnvironment <%= @options['PermitUserEnvironment'] %>
  <% else -%>
  #PermitUserEnvironment no
  <% end -%>
  <% if @options['Compression'] -%>
  Compression <%= @options['Compression'] %>
  <% else -%>
  #Compression delayed
  <% end -%>
  <% if @options['ClientAliveInterval'] -%>
  ClientAliveInterval <%= @options['ClientAliveInterval'] %>
  <% else -%>
  #ClientAliveInterval 0
  <% end -%>
  <% if @options['ClientAliveCountMax'] -%>
  ClientAliveCountMax <%= @options['ClientAliveCountMax'] %>
  <% else -%>
  #ClientAliveCountMax 3
  <% end -%>
  <% if @options['UseDNS'] -%>
  UseDNS <%= @options['UseDNS'] %>
  <% else -%>
  #UseDNS yes
  <% end -%>
  <% if @options['PidFile'] -%>
  PidFile <%= @options['PidFile'] %>
  <% else -%>
  #PidFile /var/run/sshd.pid
  <% end -%>
  <% if @options['MaxStartups'] -%>
  MaxStartups <%= @options['MaxStartups'] %>
  <% else -%>
  #MaxStartups 10:30:100
  <% end -%>
  <% if @options['PermitTunnel'] -%>
  PermitTunnel <%= @options['PermitTunnel'] %>
  <% else -%>
  #PermitTunnel no
  <% end -%>
  <% if @options['ChrootDirectory'] -%>
  ChrootDirectory <%= @options['ChrootDirectory'] %>
  <% else -%>
  #ChrootDirectory none
  <% end -%>
  <% if @options['VersionAddendum'] -%>
  VersionAddendum <%= @options['VersionAddendum'] %>
  <% else -%>
  #VersionAddendum none
  <% end -%>
  
  # no default banner path
  <% if @options['Banner'] -%>
  Banner <%= @options['Banner'] %>
  <% else -%>
  #Banner none
  <% end -%>
  