diff options
| author | Franck Cuny <franck@fcuny.net> | 2025-08-12 09:47:47 -0700 |
|---|---|---|
| committer | Franck Cuny <franck@fcuny.net> | 2025-08-12 09:47:47 -0700 |
| commit | 9b4023fb9d8ff3e0005595318ec1e1ac181a6bdf (patch) | |
| tree | a3ff00eee490ff7f5b69debed5445be4db08bff6 /profiles | |
| parent | import locale (diff) | |
| download | infra-9b4023fb9d8ff3e0005595318ec1e1ac181a6bdf.tar.gz | |
profile for sshd
Diffstat (limited to 'profiles')
| -rw-r--r-- | profiles/core/ssh.nix | 19 | ||||
| -rw-r--r-- | profiles/server.nix | 4 |
2 files changed, 19 insertions, 4 deletions
diff --git a/profiles/core/ssh.nix b/profiles/core/ssh.nix new file mode 100644 index 0000000..f8c899a --- /dev/null +++ b/profiles/core/ssh.nix @@ -0,0 +1,19 @@ +{ lib, ... }: +{ + services.openssh = { + enable = lib.mkDefault true; + settings = { + PasswordAuthentication = lib.mkForce false; + KbdInteractiveAuthentication = lib.mkForce false; + + PermitRootLogin = lib.mkForce "prohibit-password"; + }; + openFirewall = lib.mkDefault true; + hostKeys = [ + { + path = "/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + ]; + }; +} diff --git a/profiles/server.nix b/profiles/server.nix index 49a0bc7..c91546d 100644 --- a/profiles/server.nix +++ b/profiles/server.nix @@ -45,10 +45,6 @@ "1.0.0.1#cloudflare-dns.com" ]; - services.openssh.enable = true; - services.openssh.settings.PasswordAuthentication = false; - services.openssh.settings.PermitRootLogin = "no"; - users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" ]; |