thehedgehog/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

hosts/common/ssh: Add cipher/mac/kex configurations

Browse source
This commit is contained in:
The Hedgehog 2022-08-30 13:54:25 -04:00
parent cfcd525622
commit fcc27711cd
Signed by: thehedgehog
GPG key ID: 8CDF3F7CAA53A0F5
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
hosts/common/ssh.nix
View file

@ -4,6 +4,27 @@
permitRootLogin = "prohibit-password";
passwordAuthentication = false;
kbdInteractiveAuthentication = false;
ciphers = [
"chacha20-poly1305@openssh.com"
"aes256-gcm@openssh.com"
"aes128-gcm@openssh.com"
"aes256-ctr"
"aes192-ctr"
"aes128-ctr"
];
macs = [
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
];
kexAlgorithms = [
# Experimental, disabled for now.
# "sntrup761x25519-sha512@openssh.com"
"curve25519-sha256"
"curve25519-sha256@libssh.org"
# Disabled for being 2048-bit
# "diffie-hellman-group-exchange-sha256"
];
};
networking.firewall.allowedTCPPorts = [22];
}