From d9747c64b038943253eaafdc59a49d5face46dab Mon Sep 17 00:00:00 2001 From: Fuwn Date: Fri, 20 Sep 2024 05:36:20 -0700 Subject: modules: server and core modules --- modules/core/software/access/ssh.nix | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 modules/core/software/access/ssh.nix (limited to 'modules/core/software/access/ssh.nix') diff --git a/modules/core/software/access/ssh.nix b/modules/core/software/access/ssh.nix new file mode 100644 index 0000000..665532f --- /dev/null +++ b/modules/core/software/access/ssh.nix @@ -0,0 +1,39 @@ +{ lib, config, ... }: +{ + programs.ssh.startAgent = false; + security.pam.sshAgentAuth.enable = true; + + services = { + fail2ban.jails.sshd.settings = { + enabled = true; + filter = "sshd[mode=aggressive]"; + port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports); + }; + + openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = false; + + settings = { + StreamLocalBindUnlink = "yes"; + GatewayPorts = "clientspecified"; + + KexAlgorithms = [ + "curve25519-sha256" + "curve25519-sha256@libssh.org" + "diffie-hellman-group16-sha512" + "diffie-hellman-group18-sha512" + "diffie-hellman-group-exchange-sha256" + "sntrup761x25519-sha512@openssh.com" + ]; + + Macs = [ + "hmac-sha2-512-etm@openssh.com" + "hmac-sha2-256-etm@openssh.com" + "umac-128-etm@openssh.com" + ]; + }; + }; + }; +} -- cgit v1.2.3