diff options
| author | Kleidi Bujari <mail@4kb.net> | 2026-09-05 13:20:52 -0700 |
|---|---|---|
| committer | Kleidi Bujari <mail@4kb.net> | 2026-09-05 13:25:27 -0700 |
| commit | 531afa134dd204b61cb506a425959dcf68949c9d (patch) | |
| tree | 0e00aebe4e94041123f42b0556ddf5ccaca79770 /modules | |
| parent | bb3fc34e8adee94e8bed82a33da139b9fefd79a7 (diff) | |
| download | depot-531afa134dd204b61cb506a425959dcf68949c9d.tar.gz depot-531afa134dd204b61cb506a425959dcf68949c9d.tar.bz2 depot-531afa134dd204b61cb506a425959dcf68949c9d.zip | |
[nixos/sshd] fix pubkey accepted types and hostkey location
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/sshd.nix | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/modules/sshd.nix b/modules/sshd.nix index 6afec3f..421ab7f 100644 --- a/modules/sshd.nix +++ b/modules/sshd.nix @@ -33,7 +33,7 @@ in startWhenNeeded = true; openFirewall = true; hostKeys = lib.singleton { - path = "/persist/certs/ssh/ssh_host_ed25519_key"; + path = "/var/lib/sshd/ssh_host_ed25519_key"; type = "ed25519"; }; settings = { @@ -41,6 +41,7 @@ in X11Forwarding = false; PermitRootLogin = "prohibit-password"; PasswordAuthentication = mkDefault false; + KbdInteractiveAuthentication = false; # Ciphers = [ "chacha20-poly1305@openssh.com" ]; # Macs = [ "hmac-sha2-512-etm@openssh.com" ]; # KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; @@ -50,15 +51,14 @@ in "-f AUTHPRIV" "-l INFO" ]; - # extraConfig = - # let - # pubkeyTypes = lib.strings.concatStringsSep "," [ - # "sk-ssh-ed25519-cert-v01@openssh.com" - # "ssh-ed25519-cert-v01@openssh.com" - # "ssh-ed25519" - # ]; - # in - # "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + extraConfig = + let + pubkeyTypes = lib.strings.concatStringsSep "," [ + "sk-ssh-ed25519@openssh.com" + "ssh-ed25519" + ]; + in + "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; }; users.users.root.openssh.authorizedKeys.keys = [ |