56 lines
1.1 KiB
Nix
56 lines
1.1 KiB
Nix
{pkgs, ...}: {
|
|
# Hardened OpenSSH server
|
|
# Resources:
|
|
# https://cyber.gouv.fr/en/publications/openssh-secure-use-recommendations (2015)
|
|
services.openssh = {
|
|
enable = true;
|
|
|
|
allowSFTP = false;
|
|
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
|
|
|
|
AllowUsers = [ "user" "tasia" ];
|
|
|
|
# Public key authentiation only
|
|
PasswordAuthentication = false;
|
|
ChallengeResponseAuthentication = false;
|
|
KbdInteractiveAuthentication = true;
|
|
};
|
|
extraConfig = ''
|
|
# Only allow SSH v2
|
|
Protocol 2
|
|
|
|
|
|
# Check file modes in /etc/ssh
|
|
StrictModes yes
|
|
|
|
UsePrivilegeSeparation sandbox
|
|
PrintLastLog yes
|
|
|
|
# Don't mess with environment variables
|
|
PermitUserEnvironment no
|
|
# AcceptEnv
|
|
|
|
AllowTcpForwarding no
|
|
|
|
# wip
|
|
AllowTcpForwarding yes
|
|
X11Forwarding no
|
|
AllowAgentForwarding no
|
|
AllowStreamLocalForwarding no
|
|
AuthenticationMethods publickey
|
|
'';
|
|
};
|
|
|
|
security.pam = {
|
|
services.sshd.googleAuthenticator.enable = true;
|
|
};
|
|
environment.systemPackages = with pkgs; [
|
|
google-authenticator
|
|
];
|
|
}
|
|
# ssh R6: StrictHostKeyChecking ask
|
|
|