Emma Thorpe
f7ae46f462
CI / flake (pull_request) Successful in 3m27s
The registry / multi-user / portable-home rationale lives in the README (Users, Hosts, Portable home); the corresponding code comments are reduced to one-liners that point there. No functional change (host derivations are unchanged).
12 lines
371 B
Nix
12 lines
371 B
Nix
# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
|
|
# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
|
|
# not here.
|
|
{ ... }:
|
|
{
|
|
services.openssh.settings = {
|
|
PasswordAuthentication = false; # keys only
|
|
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
|
PermitRootLogin = "no";
|
|
};
|
|
}
|