OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      f895fbaf3f53
DATE      2025-02-01
SUBJECT   openssh: client hardening
FILES     1 CHANGED
HASH      f895fbaf3f53
DATE      2025-02-01
SUBJECT   openssh: client hardening
FILES     1 CHANGED
 

diff --git a/modules/nixos/base/openssh.nix b/modules/nixos/base/openssh.nix
index 22d7ced..428b11f 100644
--- a/modules/nixos/base/openssh.nix
+++ b/modules/nixos/base/openssh.nix
@@ -1,10 +1,34 @@
-{
+let
+  # restict key exchange, cipher, and MAC algorithms, as per <https://www.ssh-aud
it.com>
+  KexAlgorithms = [
+    "[email protected]"
+    "curve25519-sha256"
+    "[email protected]"
+    "diffie-hellman-group18-sha512"
+    "diffie-hellman-group-exchange-sha256"
+    "diffie-hellman-group16-sha512"
+  ];
+  Ciphers = [
+    "[email protected]"
+    "[email protected]"
+    "[email protected]"
+    "aes256-ctr"
+    "aes192-ctr"
+    "aes128-ctr"
+  ];
+  Macs = [
+    "[email protected]"
+    "[email protected]"
+    "[email protected]"
+  ];
+in {
   services = {
     openssh = {
       enable = true;
       startWhenNeeded = true;
       ports = [22];
       settings = {
+        inherit KexAlgorithms Ciphers Macs;
         UseDns = true;
         PubkeyAuthentication = "yes";
         PermitRootLogin = "no";
@@ -15,36 +39,28 @@
         IgnoreRhosts = "yes";
 
         # by default openssh uses port 22
-
-        # restict key exchange, cipher, and MAC algorithms, as per <https://www.s
sh-audit.com>
-        KexAlgorithms = [
-          "[email protected]"
-          "curve25519-sha256"
-          "[email protected]"
-          "diffie-hellman-group18-sha512"
-          "diffie-hellman-group-exchange-sha256"
-          "diffie-hellman-group16-sha512"
-          "ecdh-sha2-nistp256"
-        ];
-        Ciphers = [
-          "[email protected]"
-          "aes128-ctr"
-          "aes192-ctr"
-          "aes256-ctr"
-          "[email protected]"
-          "[email protected]"
-        ];
-        Macs = [
-          "[email protected]"
-          "[email protected]"
-          "[email protected]"
-        ];
       };
     };
+    # client
     fail2ban.jails.sshd.settings = {
       enable = true;
       filter = "sshd";
       mode = "aggressive";
     };
   };
+  programs.ssh = {
+    startAgent = true;
+    macs = Macs;
+    kexAlgorithms = KexAlgorithms;
+    ciphers = Ciphers;
+    hostKeyAlgorithms = [
+      "[email protected]"
+      "[email protected]"
+      "[email protected]"
+      "[email protected]"
+      "ssh-ed25519"
+      "rsa-sha2-512"
+      "rsa-sha2-256"
+    ];
+  };
 }


diff --git a/modules/nixos/base/openssh.nix 
b/modules/nixos/base/openssh.nix
index 22d7ced..428b11f 100644
--- a/modules/nixos/base/openssh.nix
+++ b/modules/nixos/base/openssh.nix
@@ -1,10 +1,34 @@
-{
+let
+  # restict key exchange, cipher, and MAC a
lgorithms, as per <https://www.ssh-audit.com
>
+  KexAlgorithms = [
+    "[email protected]"
+    "curve25519-sha256"
+    "[email protected]"
+    "diffie-hellman-group18-sha512"
+    "diffie-hellman-group-exchange-sha256"
+    "diffie-hellman-group16-sha512"
+  ];
+  Ciphers = [
+    "[email protected]"
+    "[email protected]"
+    "[email protected]"
+    "aes256-ctr"
+    "aes192-ctr"
+    "aes128-ctr"
+  ];
+  Macs = [
+    "[email protected]"
+    "[email protected]"
+    "[email protected]"
+  ];
+in {
   services = {
     openssh = {
       enable = true;
       startWhenNeeded = true;
       ports = [22];
       settings = {
+        inherit KexAlgorithms Ciphers Macs;
         UseDns = true;
         PubkeyAuthentication = "yes";
         PermitRootLogin = "no";
@@ -15,36 +39,28 @@
         IgnoreRhosts = "yes";
 
         # by default openssh uses port 22
-
-        # restict key exchange, cipher, and
 MAC algorithms, as per <https://www.ssh-aud
it.com>
-        KexAlgorithms = [
-          "[email protected]
om"
-          "curve25519-sha256"
-          "[email protected]"
-          "diffie-hellman-group18-sha512"
-          "diffie-hellman-group-exchange-sh
a256"
-          "diffie-hellman-group16-sha512"
-          "ecdh-sha2-nistp256"
-        ];
-        Ciphers = [
-          "[email protected]"
-          "aes128-ctr"
-          "aes192-ctr"
-          "aes256-ctr"
-          "[email protected]"
-          "[email protected]"
-        ];
-        Macs = [
-          "[email protected]"
-          "[email protected]"
-          "[email protected]"
-        ];
       };
     };
+    # client
     fail2ban.jails.sshd.settings = {
       enable = true;
       filter = "sshd";
       mode = "aggressive";
     };
   };
+  programs.ssh = {
+    startAgent = true;
+    macs = Macs;
+    kexAlgorithms = KexAlgorithms;
+    ciphers = Ciphers;
+    hostKeyAlgorithms = [
+      "[email protected]"
+      "[email protected]"
+      "[email protected]"
+      "[email protected]"
+      "ssh-ed25519"
+      "rsa-sha2-512"
+      "rsa-sha2-256"
+    ];
+  };
 }

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET