diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
index dae0449..abce170 100644
--- a/etc/ssh/sshd_config
+++ b/etc/ssh/sshd_config
@@ -103,5 +103,14 @@ PrintMotd no # pam does that
 #ChrootDirectory none
 #VersionAddendum none
 
+# Ciphers and keying
+# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com
+# hardening guide
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
+HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com
+#RekeyLimit default none
+
 # override default of no subsystems
 Subsystem	sftp	/usr/lib/ssh/sftp-server