STIG Baseline Hardening

You're deploying this server into an environment that requires a DISA-STIG-style security baseline before it can go live. Harden it against five controls: disable direct root SSH, present an authorized-use warning banner (an 'authorized use' notice in /etc/issue.net that sshd serves via its Banner directive), enforce a maximum password age of 60 days or less (the Ubuntu 22.04 STIG limit), lock down /etc/shadow permissions (0640 or stricter), and disable IP forwarding via sysctl. Grading inspects the actual system configuration, the way a compliance scanner (SCAP/OpenSCAP) would — pass all five to certify the baseline.