lbhost/conf.sshd.nix

   1 { ... }:
   2
   3 with builtins;
   4 {
   5   services.openssh = {
   6
   7     enable = trace "Enable OpenSSH" true;
   8     banner = null;
   9
  10     settings = {
  11       PermitRootLogin = "no";
  12       PasswordAuthentication = false;
  13       KbdInteractiveAuthentication = false;
  14       X11Forwarding = false;
  15       UseDns = false;
  16       Ciphers = [
  17         "chacha20-poly1305@openssh.com"
  18         "aes256-gcm@openssh.com"
  19         "aes128-gcm@openssh.com"
  20         "aes256-ctr"
  21         "aes192-ctr"
  22         "aes128-ctr"
  23       ];
  24       Macs = [
  25         "hmac-sha2-512-etm@openssh.com"
  26         "hmac-sha2-256-etm@openssh.com"
  27         "umac-128-etm@openssh.com"
  28         "hmac-sha2-512"
  29         "hmac-sha2-256"
  30         "umac-128@openssh.com"
  31       ];
  32     };
  33
  34     extraConfig = ''
  35       Protocol 2
  36       PermitUserEnvironment no
  37       IgnoreRhosts yes
  38       HostbasedAuthentication no
  39       LoginGraceTime 30
  40       MaxAuthTries 2
  41       MaxSessions 5
  42       MaxStartups 5:20:25
  43     '';
  44
  45     ports = [
  46       22
  47       44307
  48       44321
  49       44335
  50       44349
  51       44363
  52       44377
  53     ];
  54
  55     knownHosts = {
  56       "github.com/ssh-ed25519" = {
  57         hostNames = [ "github.com" ];
  58         publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
  59       };
  60       "github.com/ecdsa-sha2-nistp256" = {
  61         hostNames = [ "github.com" ];
  62         publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=";
  63       };
  64       "github.com/ssh-rsa" = {
  65         hostNames = [ "github.com" ];
  66         publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=";
  67       };
  68     };
  69   };
  70 }