derped/nixos
1
0
Fork 0
Code Releases Activity

More nginx config dehardcoding. Did some sshd hardening.

Browse source
This commit is contained in:
Kevin Baensch 2019-03-24 22:55:17 +01:00
parent 66ca5839e5
commit e745bdea3d
5 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
services/openssh.nix
View file

@ -9,13 +9,18 @@ with lib;
mkIf (elem "openssh" config.machine.services) {
services.openssh = {
enable = true;
kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
startWhenNeeded = true;
challengeResponseAuthentication = false;
passwordAuthentication = false;
permitRootLogin = "no";
extraConfig = ''
UsePAM no
UseRoaming no
AllowUsers derped git nix-ssh
UsePrivilegeSeparation sandbox
LogLevel VERBOSE
'';
};
}