Jan/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restricted SSH access

Browse Source
This commit is contained in:
Jan-Bulthuis 2025-05-30 16:15:52 +02:00
parent 46fe5b8056
commit 0cf53a97cf
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
modules/nixos/ssh.nix
View File

@ -9,10 +9,14 @@ in
enable = mkEnableOption "ssh"; enable = mkEnableOption "ssh";
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.openssh.enable = true; services.openssh = {
# TODO: Is this default configuration secure? enable = true;
settings = {
services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [ PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
hostKeys = mkIf (config.modules.impermanence.enable) [
{ {
type = "ed25519"; type = "ed25519";
path = "/persist/system/etc/ssh/ssh_host_ed25519_key"; path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
@ -24,4 +28,5 @@ in
} }
]; ];
}; };
};
} }