Port Modules/Security/secharden-ssh.sh.
Deploys:
- Authorized keys for root, localuser, subodev (conditional on existence)
- Hardened /etc/ssh/sshd_config (skipped on dev workstations)
- ssh-audit hardening drop-in for algorithm restrictions (skipped on
Ubuntu where it breaks openssh-server)
- Lockdown of sshd_config.d directory permissions
SSH service is validated (sshd -t) before restart.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
