openssh:
  sshd_enable: True
  sshd_config: /etc/ssh/sshd_config
  sshd_config_src: salt://openssh/files/sshd_config
  ssh_config: /etc/ssh/ssh_config
  ssh_config_src: salt://openssh/files/ssh_config
  banner: /etc/ssh/banner
  banner_src: salt://openssh/files/banner
  ssh_known_hosts: /etc/ssh/ssh_known_hosts
  dig_pkg: dnsutils
  ssh_moduli: /etc/ssh/moduli
  root_group: root
  KexAlgorithms:
    - 'curve25519-sha256@libssh.org'
    - 'diffie-hellman-group-exchange-sha256'
  Ciphers:
    - 'chacha20-poly1305@openssh.com'
    - 'aes256-gcm@openssh.com'
    - 'aes128-gcm@openssh.com'
    - 'aes256-ctr'
    - 'aes192-ctr'
    - 'aes128-ctr'
  MACs:
    - 'hmac-sha2-512-etm@openssh.com'
    - 'hmac-sha2-256-etm@openssh.com'
    - 'hmac-ripemd160-etm@openssh.com'
    - 'umac-128-etm@openssh.com'
    - 'hmac-sha2-512'
    - 'hmac-sha2-256'
    - 'hmac-ripemd160'
    - 'umac-128@openssh.com'

sshd_config: {}
ssh_config:
  Hosts:
    '*':
      SendEnv: LANG LC_*
      HashKnownHosts: yes
      GSSAPIAuthentication: yes
      GSSAPIDelegateCredentials: no