Jan/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restricted SSH access

Browse Source
This commit is contained in:
Jan-Bulthuis 2025-05-30 16:15:52 +02:00
parent 46fe5b8056
commit 0cf53a97cf
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
modules/nixos/ssh.nix
View File

@ -9,19 +9,24 @@ in
enable = mkEnableOption "ssh"; enable = mkEnableOption "ssh";
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.openssh.enable = true; services.openssh = {
# TODO: Is this default configuration secure? enable = true;
settings = {
services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [ PasswordAuthentication = false;
{ KbdInteractiveAuthentication = false;
type = "ed25519"; PermitRootLogin = "no";
path = "/persist/system/etc/ssh/ssh_host_ed25519_key"; };
} hostKeys = mkIf (config.modules.impermanence.enable) [
{ {
type = "rsa"; type = "ed25519";
bits = 4096; path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
path = "/persist/system/etc/ssh/ssh_host_rsa_key"; }
} {
]; type = "rsa";
bits = 4096;
path = "/persist/system/etc/ssh/ssh_host_rsa_key";
}
];
};
}; };
} }