Change auth methods to opt-out, keep key generation opt-in

Authentication methods now ENABLED by default (opt-out):
- -DisablePubkeyAuthentication (was -EnablePubkeyAuthentication)
- -DisablePasswordAuthentication (unchanged)
- -DisableCertificateAuthentication (was -EnableCertificateAuthentication)

Key generation remains OPT-IN:
- -GenerateKeyPair still requires explicit use

Config changes:
- All auth settings now idempotent (only modify if value differs)
- Certificate auth auto-enables if CA bundle exists
- Disabling cert auth comments out TrustedUserCAKeys line

Updated README with new parameter names and examples

README.md

@@ -34,12 +34,12 @@ cd Invoke-OpenSSHConfiguration
 |-----------|------|-------------|
 | `-Mode` | String | Installation mode: `Client` or `Server` |
 | `-PublicKeyList` | String[] | Array of public keys to add to `administrators_authorized_keys` |
-| `-GenerateKeyPair` | Switch | Generate SSH host key pair |
+| `-GenerateKeyPair` | Switch | Generate SSH host key pair (opt-in) |
 | `-KeyType` | String | Key algorithm: `rsa`, `ecdsa`, `ed25519` (default: `ed25519`) |
 | `-KeyBits` | Int | Key size: 256, 384, 521 (ECDSA) or 2048, 3072, 4096 (RSA) |
-| `-EnablePubkeyAuthentication` | Switch | Enable `PubkeyAuthentication yes` in sshd_config |
-| `-DisablePasswordAuthentication` | Switch | Disable password authentication (`PasswordAuthentication no`) |
-| `-EnableCertificateAuthentication` | Switch | Configure `TrustedUserCAKeys` for certificate auth |
+| `-DisablePubkeyAuthentication` | Switch | Disable public key authentication (enabled by default) |
+| `-DisablePasswordAuthentication` | Switch | Disable password authentication (enabled by default) |
+| `-DisableCertificateAuthentication` | Switch | Disable certificate authentication (enabled by default if CA bundle exists) |
 | `-TrustWindowsCertificateAuthorities` | Switch | Export Windows CA certificates to PEM bundle |
 | `-CAInclusionExpression` | String | Regex to filter CAs by Subject or Thumbprint (include matches) |
 | `-CAExclusionExpression` | String | Regex to filter CAs by Subject or Thumbprint (exclude matches) |
@@ -96,22 +96,20 @@ This exports all unexpired Root and Intermediate CA certificates from the Window
 ### Full Server Configuration
 
 ```powershell
+# All auth methods enabled by default, just add keys and trust CAs
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
     -PublicKeyList @('ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... admin@corp') `
     -GenerateKeyPair `
     -KeyType ed25519 `
     -TrustWindowsCertificateAuthorities `
-    -EnableCertificateAuthentication `
-    -EnablePubkeyAuthentication `
-    -DisablePasswordAuthentication `
     -LogDirectory 'C:\Logs\OpenSSH'
 ```
 
 ### Hardened Server (Keys Only, No Passwords)
 
 ```powershell
+# Disable password auth, keep pubkey and cert auth enabled
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
-    -EnablePubkeyAuthentication `
     -DisablePasswordAuthentication
 ```
 
@@ -121,20 +119,17 @@ This exports all unexpired Root and Intermediate CA certificates from the Window
 # Only trust CAs with "Corp" or "Enterprise" in the subject
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
     -TrustWindowsCertificateAuthorities `
-    -CAInclusionExpression '(Corp|Enterprise)' `
-    -EnableCertificateAuthentication
+    -CAInclusionExpression '(Corp|Enterprise)'
 
 # Trust all CAs except Microsoft root CAs
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
     -TrustWindowsCertificateAuthorities `
-    -CAExclusionExpression 'Microsoft' `
-    -EnableCertificateAuthentication
+    -CAExclusionExpression 'Microsoft'
 
 # Trust specific CA by thumbprint pattern
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
     -TrustWindowsCertificateAuthorities `
-    -CAInclusionExpression '^A1B2C3' `
-    -EnableCertificateAuthentication
+    -CAInclusionExpression '^A1B2C3'
 ```
 
 ### Custom SFTP Server Path
@@ -210,13 +205,16 @@ The toolkit includes reusable functions in `Toolkit\Functions\`:
 - No certificate expiry warnings
 
 ### Features Implemented
-- ✅ Password authentication control (`-DisablePasswordAuthentication`)
+- ✅ Authentication methods enabled by default (opt-out via `-Disable*` switches)
+  - PubKey, Password, Certificate auth all enabled unless explicitly disabled
+- ✅ Key generation opt-in (`-GenerateKeyPair`)
 - ✅ Service auto-start and start (automatic, no switches needed)
 - ✅ Windows Firewall rules (automatic per-profile: Domain, Private, Public)
 - ✅ Port configuration (`-SSHPort`, default 22)
-- ✅ Config backup before modification (automatic timestamped backups)
+- ✅ Config backup before modification (automatic, keeps last 3)
 - ✅ Config validation (`sshd -t`) before restart with automatic rollback
 - ✅ CA selection via regex (`-CAInclusionExpression`, `-CAExclusionExpression`)
+- ✅ Session user certificate access (reads from HKEY_USERS when running as SYSTEM)
 - ✅ SFTP subsystem (configured automatically, custom path via `-SFTPSubsystemPath`)
 
 ## Troubleshooting