oysteikt/nix-dotfiles
oysteikt/nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity

common/openssh: more config

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit 2025-03-17 09:48:19 +01:00
parent 8e5e6d7a44
commit e1e9e7a398
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
2 changed files with 21 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
hosts/common/services/openssh.nix
View File

@ -1,12 +1,32 @@
{ ... }:
{ lib, ... }:
{
services.openssh = {
enable = lib.mkDefault true;
startWhenNeeded = true;
settings = {
StreamLocalBindUnlink = true;
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
PermitEmptyPasswords = false;
ChallengeResponseAuthentication = false;
GSSAPIAuthentication = false;
HostbasedAuthentication = false;
IgnoreRhosts = true;
KerberosAuthentication = false;
RhostsRSAAuthentication = false;
Protocol = "2";
Macs = [
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
"hmac-sha2-512"
];
};
};
# systemd.services."sshd@".serviceConfig = {
# Nice = -15;
# IOSchedulingClass = "realtime";
# };
}

13
hosts/tsuki/configuration.nix
View File

@ -57,19 +57,6 @@
firewall.enable=true;
};
services.openssh.enable = true;
services.openssh.settings.Macs = [
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
"hmac-sha2-512"
];
systemd.services."sshd@".serviceConfig = {
Nice = -15;
IOSchedulingClass = "realtime";
};
users = {
users = {
media = {