kris/nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh: add security

Browse Source
This commit is contained in:
Kris
2025-10-24 16:14:05 +03:00
parent 08b68d6c53
commit c226c1bdb3
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
modules/nixos/programs.nix
View File

@@ -26,9 +26,24 @@
c-ares ffmpeg gtk3 http-parser libevent libvpx libxslt minizip nss re2 snappy libnotify libappindicator-gtk3 c-ares ffmpeg gtk3 http-parser libevent libvpx libxslt minizip nss re2 snappy libnotify libappindicator-gtk3
]; ];
services.fail2ban = {
enable = true;
# Ban IP after 5 failures
maxretry = 5;
ignoreIP = [
"10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
];
};
services.openssh = { services.openssh = {
enable = true; enable = true;
ports = [ 22 ]; ports = [ 22 ];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
AllowUsers = [ "ocbwoy3" "git" ];
};
# fucks up ssh connections from iphone if you enable this # fucks up ssh connections from iphone if you enable this
# settings = { # settings = {
# KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; # KexAlgorithms = [ "curve25519-sha256@libssh.org" ];