{...}: {
  programs.ssh = {
    # disable unnecessary forwardings
    forwardX11 = false;

    # explicitly define cryptography algorithms to avoid the use of weak algorithms
    # AES CTR modes have been removed to mitigate the Terrapin attack
    # https://terrapin-attack.com/
    ciphers = [
      "aes256-gcm@openssh.com"
      "aes128-gcm@openssh.com"
    ];
    hostKeyAlgorithms = [
      "ssh-ed25519"
      "ssh-ed25519-cert-v01@openssh.com"
      "sk-ssh-ed25519@openssh.com"
      "sk-ssh-ed25519-cert-v01@openssh.com"
      "rsa-sha2-256"
      "rsa-sha2-256-cert-v01@openssh.com"
      "rsa-sha2-512"
      "rsa-sha2-512-cert-v01@openssh.com"
    ];
    macs = [
      "hmac-sha2-256-etm@openssh.com"
      "hmac-sha2-512-etm@openssh.com"
      "umac-128-etm@openssh.com"
    ];
    kexAlgorithms = [
      "curve25519-sha256"
      "curve25519-sha256@libssh.org"
      "diffie-hellman-group16-sha512"
      "diffie-hellman-group18-sha512"
    ];
    extraConfig = "
      # disable unnecessary forwardings
      ForwardAgent no
      ForwardX11Trusted no
      GatewayPorts no
      Tunnel no

      # disable unnecessary authentication methods
      ChallengeResponseAuthentication no
      GSSAPIAuthentication no
      HostbasedAuthentication no

      # define authentication methods to be used
      PasswordAuthentication yes
      PubkeyAuthentication yes
      PreferredAuthentications publickey,password

      # disable pre-connection compression as it could cause security issues
      Compression no

      # in addition to checking a host's hostname, also check the host's IP address
      # this provides extra safety against DNS spoofing attacks
      CheckHostIP yes

      # ask the user if the user wants to accept the new host's host key
      StrictHostKeyChecking ask

      # hash the entries in the known_hosts file to prevent disclosure
      # of the file's content
      HashKnownHosts yes

      # send a keepalive message to the server when the session has been idle for 60 seconds
      # this prevents/detects connection timeouts
      ServerAliveInterval 60

      # increase the number of password retries
      NumberOfPasswordPrompts 5

      # display an ASCII art of the server's host key
      VisualHostKey yes
    ";
  };
}
