openssh: secure

1 files changed, 27 insertions, 6 deletions

diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index 09ff58f7..cd7ec025 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -14,18 +14,39 @@
           type = "ed25519";
         }
       ];
+      ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
+      macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
+      kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
+      moduliFile = config.sops.secrets.ssh_moduli.path;
+    };
+
+    programs.ssh = {
+      ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
+      hostKeyAlgorithms = [ "ssh-ed25519-cert-v01@openssh.com" "ssh-rsa-cert-v01@openssh.com" "ssh-ed25519" "ssh-rsa" ];
+      kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
+      macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
+      pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ];
+      extraConfig = ''
+        Host *
+          UseRoaming no
+      '';
     };
 
     sops.secrets = lib.mkIf config.services.openssh.enable {
       ssh_host_rsa_key = {
-          key = "rsa";
-          path = "/etc/ssh/ssh_host_rsa_key";
-          sopsFile = ./host-keys + "/${hostName}.yaml";
+        key = "rsa";
+        path = "/etc/ssh/ssh_host_rsa_key";
+        sopsFile = ./host-keys + "/${hostName}.yaml";
       };
       ssh_host_ed25519_key = {
-          key = "ed25519";
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          sopsFile = ./host-keys + "/${hostName}.yaml";
+        key = "ed25519";
+        path = "/etc/ssh/ssh_host_ed25519_key";
+        sopsFile = ./host-keys + "/${hostName}.yaml";
+      };
+      ssh_moduli = {
+        format = "binary";
+        path = "/etc/ssh/moduli";
+        sopsFile = ./host-moduli + "/${hostName}";
       };
     };