OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
 
main @ 71 LINES
 
[ HISTORY ]  [ UP ]
 

{config, ...}: let
  # restict key exchange, cipher, and MAC algorithms, as per <https://www.ssh-audi
t.com>
  KexAlgorithms = [
    "[email protected]"
    "curve25519-sha256"
    "[email protected]"
    "diffie-hellman-group18-sha512"
    "diffie-hellman-group-exchange-sha256"
    "diffie-hellman-group16-sha512"
  ];
  Ciphers = [
    "[email protected]"
    "[email protected]"
    "[email protected]"
    "aes256-ctr"
    "aes192-ctr"
    "aes128-ctr"
  ];
  Macs = [
    "[email protected]"
    "[email protected]"
    "[email protected]"
  ];
  inherit (config.ooknet.host) role;
in {
  services = {
    openssh = {
      enable = true;
      startWhenNeeded = true;
      ports = [22];
      settings = {
        inherit KexAlgorithms Ciphers Macs;
        UseDns = true;
        PubkeyAuthentication = "yes";
        PermitRootLogin =
          if (role == "installer")
          then "prohibit-password"
          else "no";
        PermitEmptyPasswords = "no";
        PasswordAuthentication = false;

        # disable support for .rhost files
        IgnoreRhosts = "yes";

        # by default openssh uses port 22
      };
    };
    # client
    fail2ban.jails.sshd.settings = {
      enable = true;
      filter = "sshd";
      mode = "aggressive";
    };
  };
  programs.ssh = {
    startAgent = true;
    macs = Macs;
    kexAlgorithms = KexAlgorithms;
    ciphers = Ciphers;
    hostKeyAlgorithms = [
      "[email protected]"
      "[email protected]"
      "[email protected]"
      "[email protected]"
      "ssh-ed25519"
      "rsa-sha2-512"
      "rsa-sha2-256"
    ];
  };
}


{config, ...}: let
  # restict key exchange, cipher, and MAC al
gorithms, as per <https://www.ssh-audit.com>
  KexAlgorithms = [
    "[email protected]"
    "curve25519-sha256"
    "[email protected]"
    "diffie-hellman-group18-sha512"
    "diffie-hellman-group-exchange-sha256"
    "diffie-hellman-group16-sha512"
  ];
  Ciphers = [
    "[email protected]"
    "[email protected]"
    "[email protected]"
    "aes256-ctr"
    "aes192-ctr"
    "aes128-ctr"
  ];
  Macs = [
    "[email protected]"
    "[email protected]"
    "[email protected]"
  ];
  inherit (config.ooknet.host) role;
in {
  services = {
    openssh = {
      enable = true;
      startWhenNeeded = true;
      ports = [22];
      settings = {
        inherit KexAlgorithms Ciphers Macs;
        UseDns = true;
        PubkeyAuthentication = "yes";
        PermitRootLogin =
          if (role == "installer")
          then "prohibit-password"
          else "no";
        PermitEmptyPasswords = "no";
        PasswordAuthentication = false;

        # disable support for .rhost files
        IgnoreRhosts = "yes";

        # by default openssh uses port 22
      };
    };
    # client
    fail2ban.jails.sshd.settings = {
      enable = true;
      filter = "sshd";
      mode = "aggressive";
    };
  };
  programs.ssh = {
    startAgent = true;
    macs = Macs;
    kexAlgorithms = KexAlgorithms;
    ciphers = Ciphers;
    hostKeyAlgorithms = [
      "[email protected]"
      "[email protected]"
      "[email protected]"
      "[email protected]"
      "ssh-ed25519"
      "rsa-sha2-512"
      "rsa-sha2-256"
    ];
  };
}

 
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET