AcceptEnv LANG LC_*
    AllowAgentForwarding no
    AllowGroups ssh-user
    AllowStreamLocalForwarding no
    AllowTCPForwarding no
    AllowUsers restricted [email protected]/24 [email protected]/24 sftp
    AuthenticationMethods publickey,keyboard-interactive:pam
    AuthorizedKeysFile .ssh/authorized_keys
    Banner /etc/issue.net
    ChallengeResponseAuthentication yes
    Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr
    ClientAliveCountMax 6
    ClientAliveInterval 30
    Compression no
    DebianBanner no
    DenyGroups root nobody
    DenyUsers root nobody
    GatewayPorts no
    GSSAPIAuthentication no
    GSSAPIKeyExchange no
    HostbasedAuthentication no
    HostKey /etc/ssh/ssh_host_ed25519_key
    IgnoreRhosts yes
    KbdInteractiveAuthentication no
    KerberosAuthentication no
    KexAlgorithms [email protected],diffie-hellman-group18-sha512,diffie-hellman-group16-sha512
    LoginGraceTime 60
    LogLevel VERBOSE
    MACs [email protected],[email protected],[email protected]
    MaxAuthTries 5
    maxsessions 5
    maxstartups 10:30:60
    PasswordAuthentication no
    PermitEmptyPasswords no
    PermitRootLogin no
    PermitTunnel no
    PermitUserEnvironment no
    PermitUserRC no
    Port 65028
    PrintMotd no
    Protocol 2
    PubkeyAuthentication yes
    RekeyLimit 512M 1h
    StrictModes yes
    Subsystem sftp /usr/lib/ssh/sftp-server
    TCPKeepAlive no
    UsePAM yes
    X11Forwarding no

    Match User sftp
            ForceCommand internal-sftp
            AuthenticationMethods publickey
            PasswordAuthentication no
            ChrootDirectory /srv/sftp
            PermitTunnel no
            AllowAgentForwarding no
            AllowTcpForwarding no
            X11Forwarding no