sec: harden ssh config

2025-09-04 20:21:18 +05:00
parent 3a66870244
commit c923c80cbf
1 changed files with 8 additions and 0 deletions
--- a/hosts/common/optional/services/openssh.nix
+++ b/hosts/common/optional/services/openssh.nix
@@ -4,6 +4,14 @@ in {
  services.openssh = {
    enable = true;
    ports = [ sshPort ];
+
+    settings = {
+      PermitRootLogin = "no";
+      KbdInteractiveAuthentication = false;
+      PasswordAuthentication = false;
+    };
+
+    openFirewall = true;
  };

  networking.firewall.allowedTCPPorts = [ sshPort ];