summaryrefslogtreecommitdiff
path: root/system-profiles/openssh
diff options
context:
space:
mode:
Diffstat (limited to 'system-profiles/openssh')
-rw-r--r--system-profiles/openssh/default.nix44
1 files changed, 38 insertions, 6 deletions
diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index cc4ecdf0..8f0bd11b 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -8,7 +8,7 @@ in {
8 options = { 8 options = {
9 services.openssh.staticHostKeys = mkOption { 9 services.openssh.staticHostKeys = mkOption {
10 type = types.bool; 10 type = types.bool;
11 default = true; 11 default = pathExists (./host-keys + "/${hostName}.yaml");
12 }; 12 };
13 }; 13 };
14 14
@@ -18,13 +18,45 @@ in {
18 services.openssh = mkIf cfg.enable { 18 services.openssh = mkIf cfg.enable {
19 hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually 19 hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
20 settings = { 20 settings = {
21 Ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; 21 Ciphers = [
22 Macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ]; 22 "chacha20-poly1305@openssh.com"
23 KexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; 23 "aes256-gcm@openssh.com"
24 "aes256-ctr"
25 ];
26 Macs = [
27 "hmac-sha2-256-etm@openssh.com"
28 "hmac-sha2-256"
29 "hmac-sha2-512-etm@openssh.com"
30 "hmac-sha2-512"
31 ];
32 KexAlgorithms = [
33 "sntrup761x25519-sha512@openssh.com"
34 "curve25519-sha256"
35 "curve25519-sha256@libssh.org"
36 "diffie-hellman-group-exchange-sha256"
37 ];
38 HostKeyAlgorithms = concatStringsSep "," [
39 "sk-ssh-ed25519-cert-v01@openssh.com"
40 "ssh-ed25519-cert-v01@openssh.com"
41 "rsa-sha2-256-cert-v01@openssh.com"
42 "rsa-sha2-512-cert-v01@openssh.com"
43 "sk-ssh-ed25519@openssh.com"
44 "ssh-ed25519"
45 "rsa-sha2-256"
46 "rsa-sha2-512"
47 ];
48 CASignatureAlgorithms = concatStringsSep "," [
49 "sk-ssh-ed25519@openssh.com"
50 "ssh-ed25519"
51 "rsa-sha2-256"
52 "rsa-sha2-512"
53 ];
54
24 LogLevel = "VERBOSE"; 55 LogLevel = "VERBOSE";
25 HostKeyAlgorithms = "sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512";
26 CASignatureAlgorithms = "sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512";
27 RevokedKeys = "/etc/ssh/krl.bin"; 56 RevokedKeys = "/etc/ssh/krl.bin";
57
58 PasswordAuthentication = mkDefault false;
59 KbdInteractiveAuthentication = mkDefault false;
28 }; 60 };
29 moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path; 61 moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path;
30 extraConfig = '' 62 extraConfig = ''