Mirror/nix-git
Mirror/nix-git
1
0
Fork 0
mirror of https://codeberg.org/privacy1st/nix-git synced 2025-01-12 05:06:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

ssh: disable KbdInteractiveAuthentication by only allowing PubkeyAuthentication

Browse Source
This commit is contained in:
Daniel Langbein 2024-12-08 09:50:19 +01:00
parent 40ed2bc37b
commit 9d5337012d
Signed by: langfingaz
GPG Key ID: 6C47C753F0823002
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
modules/ssh-server.nix
View File

@ -18,10 +18,22 @@
# Enabling this is required for commands such as sftp and sshfs. # Enabling this is required for commands such as sftp and sshfs.
allowSFTP = false; allowSFTP = false;
settings = { # Only authentication method should be public key.
# Use authorized keys only. #
PasswordAuthentication = false; # https://man.archlinux.org/man/core/openssh/sshd_config.5.en#AuthenticationMethods
# - We change the default of AuthenticationMethods from `any` to `publickey`.
# - Furthermore, we explicitly PubkeyAuthentication to its default value `yes`.
#
# https://nixos.wiki/wiki/SSH_public_key_authentication#SSH_server_config
# Alternatively we could use
# settings.PasswordAuthentication = false;
# settings.KbdInteractiveAuthentication = false;
extraConfig = ''
AuthenticationMethods publickey
PubkeyAuthentication yes
'';
settings = {
# #
# https://infosec.mozilla.org/guidelines/openssh # https://infosec.mozilla.org/guidelines/openssh
# #