nixos/services/openssh.nix

43 lines
1.2 KiB
Nix
Raw Normal View History

2023-09-11 20:23:04 +02:00
{
config,
lib,
fn,
...
}:
# For reference:
# https://infosec.mozilla.org/guidelines/openssh.html
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
with lib;
2023-09-11 20:23:04 +02:00
mkIf (elem "openssh" config.machine.services) {
services.openssh = {
enable = true;
settings.KexAlgorithms = ["curve25519-sha256@libssh.org"];
sftpFlags = ["-f AUTHPRIV" "-l INFO"];
startWhenNeeded = false;
settings = {
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
PermitRootLogin = "no";
};
extraConfig = let
users =
concatMapStrings (user: "${user.name} ") config.machine.administrators
2024-05-09 12:41:24 +02:00
+ (optionalString config.services.forgejo.enable (config.services.forgejo.user + " "));
2023-09-11 20:23:04 +02:00
in ''
UsePAM no
AllowUsers ${users}
LogLevel VERBOSE
2023-09-11 20:23:04 +02:00
'';
};
# Add public keys to /etc/ssh/authorized_keys.d
# This replaces users.users.*.openssh.authorizedKeys.*
2023-09-11 21:20:14 +02:00
sops.secrets =
2023-09-11 20:23:04 +02:00
fn.sopsHelper
(user: "users/${user.name}/publicKey")
config.machine.administrators
(user: {
path = "/etc/ssh/authorized_keys.d/${user.name}";
mode = "444";
2023-09-11 21:20:14 +02:00
});
2023-09-11 20:23:04 +02:00
}