1 files changed, 4 insertions, 0 deletions

diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index e60e72d9..774c2f20 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -66,11 +66,15 @@ in {
     services.openssh = mkIf cfg.enable {
       startWhenNeeded = true;
       hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
+      authorizedKeysInHomedir = mkDefault false;
       settings = {
         inherit Ciphers Macs KexAlgorithms;
         HostKeyAlgorithms = concatStringsSep "," HostKeyAlgorithms;
         PubkeyAcceptedAlgorithms = concatStringsSep "," PubkeyAcceptedAlgorithms;
         CASignatureAlgorithms = concatStringsSep "," CASignatureAlgorithms;
+        TrustedUserCAKeys = toString (pkgs.writeText "trusted_user_ca_keys" ''
+          ${builtins.readFile ./ca/ca.pub}
+        '');
 
         LogLevel = "VERBOSE";
         RevokedKeys = toString ./ca/krl.bin;