12 lines
371 B
Nix
12 lines
371 B
Nix
 
|
# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
|
||
|
|
# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
|
||
|
|
# not here.
|
||
|
|
{ ... }:
|
||
|
|
{
|
||
|
|
services.openssh.settings = {
|
||
|
|
PasswordAuthentication = false; # keys only
|
||
|
|
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
||
|
|
PermitRootLogin = "no";
|
||
|
|
};
|
||
|
|
}
|