nixos/config/common/services/ssh.nix

29 lines
785 B
Nix
Raw Normal View History

{ ... }:
{
2021-11-22 14:12:43 +00:00
services.openssh = {
enable = true;
permitRootLogin = "no";
passwordAuthentication = false;
challengeResponseAuthentication = false;
kexAlgorithms = [ "curve25519-sha256" "curve25519-sha256@libssh.org" ];
2021-11-22 13:43:34 +00:00
ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes128-gcm@openssh.com" "aes256-ctr" "aes192-ctr" "aes128-ctr" ];
2021-11-22 14:12:43 +00:00
macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "umac-128-etm@openssh.com" ];
2021-11-22 13:43:34 +00:00
extraConfig = "
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
";
2021-11-22 14:12:43 +00:00
};
2021-11-22 14:12:43 +00:00
programs.ssh.knownHosts = {
despondos = {
hostNames = [ "despondos.nao.sh" ];
publicKeyFile = ../data/pubkeys/despondos_host_ed25519_key.pub;
};
};
2021-11-22 14:12:43 +00:00
#services.sshguard = {
# enable = true;
# blocktime = 300;
#};
}