blob: 8f0bd11b03d2335e66f95265f72652a7218c391a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
{ customUtils, lib, config, hostName, pkgs, ... }:
with lib;
let
cfg = config.services.openssh;
in {
options = {
services.openssh.staticHostKeys = mkOption {
type = types.bool;
default = pathExists (./host-keys + "/${hostName}.yaml");
};
};
config = {
systemd.user.services."ssh-agent".enable = mkForce false; # ssh-agent should be done via home-manager
services.openssh = mkIf cfg.enable {
hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
settings = {
Ciphers = [
"chacha20-poly1305@openssh.com"
"aes256-gcm@openssh.com"
"aes256-ctr"
];
Macs = [
"hmac-sha2-256-etm@openssh.com"
"hmac-sha2-256"
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-512"
];
KexAlgorithms = [
"sntrup761x25519-sha512@openssh.com"
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
];
HostKeyAlgorithms = concatStringsSep "," [
"sk-ssh-ed25519-cert-v01@openssh.com"
"ssh-ed25519-cert-v01@openssh.com"
"rsa-sha2-256-cert-v01@openssh.com"
"rsa-sha2-512-cert-v01@openssh.com"
"sk-ssh-ed25519@openssh.com"
"ssh-ed25519"
"rsa-sha2-256"
"rsa-sha2-512"
];
CASignatureAlgorithms = concatStringsSep "," [
"sk-ssh-ed25519@openssh.com"
"ssh-ed25519"
"rsa-sha2-256"
"rsa-sha2-512"
];
LogLevel = "VERBOSE";
RevokedKeys = "/etc/ssh/krl.bin";
PasswordAuthentication = mkDefault false;
KbdInteractiveAuthentication = mkDefault false;
};
moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path;
extraConfig = ''
${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_ed25519_key"}
${optionalString (config.environment.etc ? "ssh/ssh_host_ed25519_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"}
${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_rsa_key"}
${optionalString (config.environment.etc ? "ssh/ssh_host_rsa_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub"}
'';
};
programs.ssh = {
knownHosts = {
"*.yggdrasil.li" = {
extraHostNames = ["*.yggdrasil"];
certAuthority = true;
publicKeyFile = ./ca/ca.pub;
};
};
knownHostsFiles = [
./known-hosts/borgbase.keys
];
ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ];
kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
macs = [ "umac-128-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128@openssh.com" "hmac-sha2-256" "hmac-sha2-512" "umac-64-etm@openssh.com" "umac-64@openssh.com"];
pubkeyAcceptedKeyTypes = [ "ssh-ed25519-cert-v01@openssh.com" "sk-ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "ssh-ed25519" "ssh-rsa" ];
extraConfig = ''
Host *
CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
PasswordAuthentication no
KbdInteractiveAuthentication no
'';
};
sops.secrets = mkIf cfg.enable {
ssh_host_rsa_key = mkIf cfg.staticHostKeys {
key = "rsa";
path = "/etc/ssh/ssh_host_rsa_key";
sopsFile = ./host-keys + "/${hostName}.yaml";
};
ssh_host_ed25519_key = mkIf cfg.staticHostKeys {
key = "ed25519";
path = "/etc/ssh/ssh_host_ed25519_key";
sopsFile = ./host-keys + "/${hostName}.yaml";
};
ssh_moduli = mkIf (pathExists (./host-moduli + "/${hostName}")) {
format = "binary";
path = "/etc/ssh/moduli";
sopsFile = ./host-moduli + "/${hostName}";
};
};
environment.etc = mkIf cfg.enable {
"ssh/ssh_host_rsa_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa.pub"; };
"ssh/ssh_host_ed25519_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519.pub"; };
"ssh/ssh_host_rsa_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa-cert.pub"; };
"ssh/ssh_host_ed25519_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; };
"ssh/krl.bin".source = ./ca/krl.bin;
};
environment.systemPackages = mkIf cfg.enable (with pkgs; [
alacritty.terminfo
]);
};
}
|
