diff options
| -rw-r--r-- | hosts/ganymede/nixos.nix | 2 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 6 | ||||
| -rw-r--r-- | modules/services/nixos/ssh.nix | 23 | ||||
| -rw-r--r-- | modules/user/nixos/default.nix | 2 |
4 files changed, 33 insertions, 0 deletions
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 75fe039..86a9983 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -23,6 +23,8 @@ networkConfig.DHCP = "yes"; }; + services.fail2ban.enable = true; + # i broke something and this fixes it environment.etc."systemd/resolved.conf.d/10-dns.conf".text = config.environment.etc."systemd/resolved.conf".text; } diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index d0ea0fa..935ecd4 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -38,5 +38,11 @@ IdentityFile /home/collin/.ssh/id_ed25519 LocalForward 8010 127.0.0.1:8010 DynamicForward 9090 + + Host io + Hostname 192.168.50.3 + User admin + IdentityFile /home/collin/.ssh/id_ed25519 + ProxyJump ganymede ''; } diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index 34265ed..ca8e618 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, hosts, ... }: let @@ -9,6 +10,9 @@ in { config = lib.mkIf cfg.enable { services.openssh = { enable = true; + + allowSFTP = false; + hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -26,11 +30,30 @@ in { settings = { PermitRootLogin = "prohibit-password"; # deploy-rs uses root account PasswordAuthentication = false; + PubkeyAuthentication = true; + KbdInteractiveAuthentication = true; # for google authenticator totp codes + AuthenticationMethods = "publickey,keyboard-interactive:pam"; }; knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts; }; + security.pam.services = { + login.googleAuthenticator.enable = true; + + sshd.text = '' + account required pam_unix.so # unix (order 10900) + + auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp # google_authenticator (order 12500) + auth sufficient pam_permit.so + + session required pam_env.so conffile=/etc/pam/environment readenv=0 # env (order 10100) + session required pam_unix.so # unix (order 10200) + session required pam_loginuid.so # loginuid (order 10300) + session optional ${pkgs.systemd}/lib/security/pam_systemd.so # systemd (order 12000) + ''; + }; + users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = hosts |> (builtins.mapAttrs (_: data: data.user_pubkey or null)) diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix index 30b03e3..7fbacd1 100644 --- a/modules/user/nixos/default.nix +++ b/modules/user/nixos/default.nix @@ -27,6 +27,8 @@ in { time.timeZone = "America/Chicago"; programs.ssh = { + systemd-ssh-proxy.enable = false; + knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts; extraConfig = '' |