Reasonable defaults for /etc/ssh/sshd_config

sshd_config

# Sources:
# https://www.digitalocean.com/community/tutorials/how-to-harden-openssh-on-ubuntu-18-04
#

PermitRootLogin no

# Limit maximum number of authentication attempts for a particular login session
MaxAuthTries 3

# Prevent certain denial-of-service attacks where multiple authentication sessions are kept open for a prolonged period of time
LoginGraceTime 20

# Use configured SSH keys for authentication
PasswordAuthentication no

PermitEmptyPasswords no

# Disable other authentication methods
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no

# Disable x forwarding unless required
X11Forwarding no

# Prevent connecting clients from passing custom environment variables
PermitUserEnvironment no

# Disable miscellaneous options for tunneling and forwarding
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no

# Disable verbose SSH banner
DebianBanner no

# Only allow users from the local network
AllowUsers pi@192.168.0.0/16