From 08d4be5b51bb595e55555cc93c47f7adc77ed1c3 Mon Sep 17 00:00:00 2001 From: Fuwn Date: Sun, 22 Sep 2024 15:15:46 -0700 Subject: core: move harware and software to desktop --- modules/desktop/software/access/ssh.nix | 39 +++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 modules/desktop/software/access/ssh.nix (limited to 'modules/desktop/software/access/ssh.nix') diff --git a/modules/desktop/software/access/ssh.nix b/modules/desktop/software/access/ssh.nix new file mode 100644 index 0000000..665532f --- /dev/null +++ b/modules/desktop/software/access/ssh.nix @@ -0,0 +1,39 @@ +{ lib, config, ... }: +{ + programs.ssh.startAgent = false; + security.pam.sshAgentAuth.enable = true; + + services = { + fail2ban.jails.sshd.settings = { + enabled = true; + filter = "sshd[mode=aggressive]"; + port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports); + }; + + openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = false; + + settings = { + StreamLocalBindUnlink = "yes"; + GatewayPorts = "clientspecified"; + + KexAlgorithms = [ + "curve25519-sha256" + "curve25519-sha256@libssh.org" + "diffie-hellman-group16-sha512" + "diffie-hellman-group18-sha512" + "diffie-hellman-group-exchange-sha256" + "sntrup761x25519-sha512@openssh.com" + ]; + + Macs = [ + "hmac-sha2-512-etm@openssh.com" + "hmac-sha2-256-etm@openssh.com" + "umac-128-etm@openssh.com" + ]; + }; + }; + }; +} -- cgit v1.2.3