jalr/nixos-configuration
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden OpenSSH service

Browse source
This commit is contained in:
Jakob Lechner 2024-05-28 19:57:19 +02:00
parent 36b2aa044f
commit 1d41915773
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
modules/sshd.nix
View file

@ -1,6 +1,20 @@
{
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings = {
KbdInteractiveAuthentication = false;
# Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
KexAlgorithms = [
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group16-sha512"
"diffie-hellman-group18-sha512"
"sntrup761x25519-sha512@openssh.com"
];
PasswordAuthentication = false;
StreamLocalBindUnlink = true; # unbind gnupg sockets if they exists
UseDns = false;
X11Forwarding = false;
};
};
}