programs/ssh/default.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

{
  config,
  lib,
  ...
}: {
  # ssh config
  home-manager.users.${config.user} = {
    programs.ssh = {
      enable = true;
      extraConfig = lib.fileContents ./config;
    };
  };

  # sshd
  services.openssh = {
    enable = true;
    ports = [22];
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      UseDns = true;
      X11Forwarding = false;
      PermitRootLogin = "no";
    };
  };

  # allow ssh port
  networking.firewall.allowedTCPPorts = [22];

  # ban evil
  services.fail2ban = {
    enable = true;
    ignoreIP = [
      # freyanet
      "10.0.0.0/14"
    ];
  };

  # add authorized keys
  users.users.${config.user} = {
    openssh.authorizedKeys.keyFiles = [
      ../../files/keys/ssh.pub
    ];
  };
}