{ lib, config, ... }:
{
  programs.ssh.startAgent = false;
  security.pam.sshAgentAuth.enable = true;

  services.fail2ban.jails.sshd.settings = {
    enabled = true;
    filter = "sshd[mode=aggressive]";
    port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports);
  };
}