diff options
Diffstat (limited to 'system-profiles/openssh/default.nix')
-rw-r--r-- | system-profiles/openssh/default.nix | 43 |
1 files changed, 27 insertions, 16 deletions
diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix index d54ea6f3..048a948f 100644 --- a/system-profiles/openssh/default.nix +++ b/system-profiles/openssh/default.nix | |||
@@ -1,33 +1,39 @@ | |||
1 | { customUtils, lib, config, hostName, pkgs, ... }: | 1 | { customUtils, lib, config, hostName, pkgs, ... }: |
2 | { | 2 | { |
3 | config = { | 3 | config = { |
4 | programs.ssh.knownHosts = lib.zipAttrsWith (_name: values: builtins.head values) (lib.mapAttrsToList (name: lib.mapAttrs' (type: value: lib.nameValuePair "${name}-${type}" value)) (customUtils.nixImport { dir = ./known-hosts; })); | ||
5 | programs.ssh.knownHostsFiles = [ | ||
6 | ./known-hosts/borgbase.keys | ||
7 | ]; | ||
8 | |||
9 | systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager | 4 | systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager |
10 | 5 | ||
11 | services.openssh = lib.mkIf config.services.openssh.enable { | 6 | services.openssh = lib.mkIf config.services.openssh.enable { |
12 | hostKeys = [ | 7 | hostKeys = lib.mkForce []; # done manually |
13 | { path = "/etc/ssh/ssh_host_rsa_key"; | ||
14 | type = "rsa"; | ||
15 | } | ||
16 | { path = "/etc/ssh/ssh_host_ed25519_key"; | ||
17 | type = "ed25519"; | ||
18 | } | ||
19 | ]; | ||
20 | ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; | 8 | ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; |
21 | macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ]; | 9 | macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ]; |
22 | kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; | 10 | kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; |
23 | moduliFile = config.sops.secrets.ssh_moduli.path; | 11 | moduliFile = config.sops.secrets.ssh_moduli.path; |
24 | extraConfig = '' | 12 | extraConfig = '' |
25 | HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 | 13 | HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 |
14 | CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 | ||
15 | |||
16 | HostKey /etc/ssh/ssh_host_ed25519_key | ||
17 | HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub | ||
18 | HostKey /etc/ssh/ssh_host_rsa_key | ||
19 | HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub | ||
20 | RevokedKeys /etc/ssh/krl.bin | ||
26 | ''; | 21 | ''; |
27 | logLevel = "VERBOSE"; | 22 | logLevel = "VERBOSE"; |
28 | }; | 23 | }; |
29 | 24 | ||
30 | programs.ssh = { | 25 | programs.ssh = { |
26 | knownHosts = { | ||
27 | "*.yggdrasil.li" = { | ||
28 | extraHostNames = ["*.yggdrasil"]; | ||
29 | certAuthority = true; | ||
30 | publicKeyFile = ./ca/ca.pub; | ||
31 | }; | ||
32 | }; | ||
33 | knownHostsFiles = [ | ||
34 | ./known-hosts/borgbase.keys | ||
35 | ]; | ||
36 | |||
31 | ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; | 37 | ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; |
32 | hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ]; | 38 | hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ]; |
33 | kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; | 39 | kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; |
@@ -35,7 +41,7 @@ | |||
35 | pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ]; | 41 | pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ]; |
36 | extraConfig = '' | 42 | extraConfig = '' |
37 | Host * | 43 | Host * |
38 | UseRoaming no | 44 | CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 |
39 | ''; | 45 | ''; |
40 | }; | 46 | }; |
41 | 47 | ||
@@ -58,8 +64,13 @@ | |||
58 | }; | 64 | }; |
59 | 65 | ||
60 | environment.etc = lib.mkIf config.services.openssh.enable { | 66 | environment.etc = lib.mkIf config.services.openssh.enable { |
61 | "ssh/ssh_host_rsa_key.pub".text = config.services.openssh.knownHosts."${hostName}-rsa".publicKey; | 67 | "ssh/ssh_host_rsa_key.pub".source = ./known-hosts + "/${hostName}/rsa.pub"; |
62 | "ssh/ssh_host_ed25519_key.pub".text = config.services.openssh.knownHosts."${hostName}-ed25519".publicKey; | 68 | "ssh/ssh_host_ed25519_key.pub".source = ./known-hosts + "/${hostName}/ed25519.pub"; |
69 | |||
70 | "ssh/ssh_host_rsa_key-cert.pub".source = ./known-hosts + "/${hostName}/rsa-cert.pub"; | ||
71 | "ssh/ssh_host_ed25519_key-cert.pub".source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; | ||
72 | |||
73 | "ssh/krl.bin".source = ./ca/krl.bin; | ||
63 | }; | 74 | }; |
64 | 75 | ||
65 | environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [ | 76 | environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [ |