sshd.cf

bundle edit_line sshd_config {

replace_patterns:
    "^.*Port (?!22).*$"                             replace_with => content("Port 22");
    "^.*Protocol (?!2).*$"                          replace_with => content("Protocol 2");
    "^.*ServerKeyBits (?!2048).*$"                  replace_with => content("ServerKeyBits 2048");
    "^.*PermitRootLogin (?!without-password).*$"    replace_with => content("PermitRootLogin without-password");
    "^.*PubkeyAuthentication (?!yes).*$"            replace_with => content("PubkeyAuthentication yes");
    "^.*PermitEmptyPasswords (?!no).*$"             replace_with => content("PermitEmptyPasswords no");
    "^.*TCPKeepAlive (?!yes).*$"                    replace_with => content("TCPKeepAlive yes");
    "^.*UseDNS (?!no).*$"                           replace_with => content("UseDNS no");
}

somewhere else {
vars:
        linux::
            "root_group" string => "root";
        freebsd::
            "root_group" string => "wheel";

commands:
        linux.restart_sshd:: "/etc/init.d/sshd restart";
        archlinux.restart_sshd:: "/etc/rc.d/sshd restart";
        freebsd.restart_sshd:: "/etc/rc.d/sshd restart";

files:
        "/etc/ssh/sshd_config"
                comment         => "Updating sshd_config",
                perms           => mog( "0440", "root", "$(root_group)" ),
                edit_line       => sshd_config,
                action          => immediate,
                classes         => if_repaired( "restart_sshd" );
}