dotfiles/Ahwxorg
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2026-07-16 22:21:55 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: configure ssh: harden default config

Browse source
This commit is contained in:
Ahwx 2026-06-30 12:49:14 +02:00
parent 90ef945ce3
commit d1b721ade5
No known key found for this signature in database
GPG key ID: 16AFF89E482AFA53
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
modules/home/ssh.nix
View file

@ -1,9 +1,37 @@
{ username, ... }:
{
programs.ssh = {
enable = true;
enableDefaultConfig = false;
extraConfig = ''
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
ForwardX11 no
ForwardX11Trusted no
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
MACS hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
Port 22
Protocol 2
PubkeyAuthentication yes
VerifyHostKeyDNS yes
'';
includes = [ "/home/${username}/config.d/*" ];
matchBlocks = {
"github.com gitlab.com" = {
user = "git";
};
"*" = {
addKeysToAgent = "yes";
compression = true;
controlMaster = "no";
controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "no";
forwardAgent = false;
hashKnownHosts = false;
# ServerAliveCountMax = 5;
# ServerAliveInterval = 15;
userKnownHostsFile = "~/.ssh/known_hosts";
};
};
};
}