secure_ssh() {
    CONF="/etc/ssh/sshd_config"
    PROFILE="/opt/server-ultimate/config/ssh-hardening.conf"

    SNAP=$(backup_create ssh "$CONF")

    echo ""
    read -p "Отключить вход по паролю? (y/N): " DISABLE_PASS

    if [[ "$DISABLE_PASS" == "y" ]]; then
        confirm_ssh_key_works || {
            err "Ключ не подтверждён. Операция отменена."
            pause
            return
        }
    fi

    # Удаляем старые параметры
    sed -i '/^PermitRootLogin/d
            /^PasswordAuthentication/d
            /^PubkeyAuthentication/d
            /^MaxAuthTries/d
            /^ClientAliveInterval/d
            /^ClientAliveCountMax/d
            /^X11Forwarding/d
            /^AllowTcpForwarding/d
            /^TCPKeepAlive/d
            /^UseDNS/d' "$CONF"

    # Применяем профиль
    cat "$PROFILE" >> "$CONF"

    # Пароль — по выбору
    if [[ "$DISABLE_PASS" != "y" ]]; then
        sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' "$CONF"
    fi

    if sshd -t; then
        systemctl restart sshd
        log "SSH security профиль применён"
    else
        err "Ошибка SSH → rollback"
        cp "$SNAP/sshd_config" "$CONF"
        systemctl restart sshd
    fi

    pause
}