docs: def restrict_ssh(rollback=False):
      """
      Set some sensible restrictions in Ubuntu /etc/ssh/sshd_config and restart sshd
      UseDNS no #prevents dns spoofing sshd defaults to yes
      X11Forwarding no # defaults to no
      AuthorizedKeysFile  %h/.ssh/authorized_keys
  
      uncomments PasswordAuthentication no and restarts sshd
      """
  
      if not rollback:
          if server_state('ssh_restricted'):
              return False
  
          sshd_config = '/etc/ssh/sshd_config'
          if env.verbosity:
              print env.host, "RESTRICTING SSH with "+sshd_config
          filename = 'sshd_config'
          if not exists('/home/%s/.ssh/authorized_keys'% env.user): #do not pass go do not collect $200
              print env.host, 'You need to upload_ssh_key first.'
              return False
          _backup_file(sshd_config)
          context = {"HOST_SSH_PORT": env.HOST_SSH_PORT}
          
          upload_template('woven/ssh/sshd_config','/etc/ssh/sshd_config',context=context,use_sudo=True)
          # Restart sshd
          sudo('/etc/init.d/ssh restart')
          
          # The user can modify the sshd_config file directly but we save
          proceed = True
          if not env.key_filename and (env.DISABLE_SSH_PASSWORD or env.INTERACTIVE) and contains('/etc/ssh/sshd_config','#PasswordAuthentication no',use_sudo=True):
              print "WARNING: You may want to test your node ssh login at this point ssh %s@%s -p%s"% (env.user, env.host, env.port)
              c_text = 'Would you like to disable password login and use only ssh key authentication'
              proceed = confirm(c_text,default=False)
      
          if not env.INTERACTIVE or proceed or env.DISABLE_SSH_PASSWORD:
              #uncomments PasswordAuthentication no and restarts
              uncomment(sshd_config,'#(\s?)PasswordAuthentication(\s*)no',use_sudo=True)
              sudo('/etc/init.d/ssh restart')
          set_server_state('ssh_restricted')
          return True
      else: #Full rollback
          _restore_file('/etc/ssh/sshd_config')
          if server_state('ssh_port_changed'):
              sed('/etc/ssh/sshd_config','Port '+ str(env.DEFAULT_SSH_PORT),'Port '+str(env.HOST_SSH_PORT),use_sudo=True)
              sudo('/etc/init.d/ssh restart')
          sudo('/etc/init.d/ssh restart')
          set_server_state('ssh_restricted', delete=True)
          return True