will-holdsworth/dots
1
1
Fork 0
Code Issues 22 Pull requests Projects 1 Releases Packages Wiki Activity Actions 1

feat(openssh): reconfigure hardening based on nixos wiki reccomendations

Browse source
This commit is contained in:
Will Holdsworth 2026-03-09 17:41:04 +11:00
parent c6135ee301
commit 383989516c
Signed by: will-holdsworth
SSH key fingerprint: SHA256:Ykee8aymMJNAiYeeEmiwcIzkA1wgd4v8OZcWGxjq12c
1 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

28
hosts/server/configuration.nix
View file

@ -42,18 +42,22 @@
}; };
# hardened openssh # hardened openssh
services.openssh = { services = {
allowSFTP = false; fail2ban.enable = true;
extraConfig = '' endlessh = {
AllowTcpForwarding yes enable = true;
X11Forwarding no port = 22;
AllowAgentForwarding no openFirewall = true;
AllowStreamLocalForwarding no };
AuthenticationMethods publickey openssh = {
''; enable = true;
settings = { ports = [ 5011 ];
KbdInteractiveAuthentication = false; settings = {
PasswordAuthentication = false; PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
AllowUsers = [ "srv" ];
};
}; };
}; };