nixos/services/openssh.nix

29 lines
824 B
Nix
Raw Normal View History

{ config, lib, ... }:
2019-02-26 13:44:40 +01:00
# For reference:
# https://infosec.mozilla.org/guidelines/openssh.html
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
with lib;
mkIf (elem "openssh" config.machine.services) {
2019-02-26 13:44:40 +01:00
services.openssh = {
enable = true;
settings.KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
startWhenNeeded = false;
settings = {
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
PermitRootLogin = "no";
};
extraConfig = let users = concatMapStrings (user: "${user.name} ") config.machine.administrators
2019-09-06 11:38:02 +02:00
+ (optionalString config.services.gitea.enable (config.services.gitea.user + " "));
in ''
UsePAM no
AllowUsers ${users}
LogLevel VERBOSE
2019-02-26 13:44:40 +01:00
'';
};
}