15 lines
659 B
Nix
15 lines
659 B
Nix
|
# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
|
||
|
|
# RPi5). The host config still does `services.openssh.enable = true` and opens
|
||
|
|
# port 22 next to where it documents the listening service; this module only
|
||
|
|
# tightens the policy so a host opting into sshd cannot accidentally ship
|
||
|
|
# password/root login. Authorized keys are owned per-user by the identity
|
||
|
|
# registry (users/registry.nix, applied via modules/users.nix), not here.
|
||
|
|
{ ... }:
|
||
|
|
{
|
||
|
|
services.openssh.settings = {
|
||
|
|
PasswordAuthentication = false; # keys only
|
||
|
|
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
||
|
|
PermitRootLogin = "no";
|
||
|
|
};
|
||
|
|
}
|