nixos-config/components/network/sshd/default.nix

87 lines
2.2 KiB
Nix
Raw Normal View History

2024-06-07 21:58:33 +02:00
{ pkgs, config, lib, assets, ... }:
2022-10-13 10:19:23 +02:00
with lib;
with types;
let
2024-06-07 21:58:33 +02:00
defaultRootKeyFiles = [ "${assets}/mrvandalo_rsa.pub" ];
2023-05-28 21:24:20 +02:00
cfg = config.components.network.sshd;
2024-04-12 22:23:06 +02:00
2024-04-16 17:19:20 +02:00
# maybe ascii-image-converter is also nice here
2024-04-12 22:23:06 +02:00
sshBanner = pkgs.runCommand "ssh-banner"
2024-06-17 11:52:14 +02:00
{ nativeBuildInputs = [ pkgs.boxes ]; } ''
2024-04-12 22:23:06 +02:00
echo "${config.networking.hostName}" | boxes -d ansi -s 80x1 -a r > $out
'';
2022-10-13 10:19:23 +02:00
in
{
imports = [
./known-hosts-public.nix
2024-06-10 17:24:21 +02:00
./known-hosts-manual.nix
./known-hosts-zerotier.nix
2022-10-13 10:19:23 +02:00
];
2023-02-17 00:41:22 +01:00
options.components.network.sshd = {
2022-10-13 10:19:23 +02:00
enable = mkOption {
type = bool;
default = true;
};
rootKeyFiles = mkOption {
type = with types; listOf path;
default = [ ];
description = "keys to root login";
};
2024-04-12 22:23:06 +02:00
sshguard.enable = mkOption {
type = bool;
default = config.components.network.sshd.enable;
};
2022-10-13 10:19:23 +02:00
onlyTincAccess = mkOption {
type = bool;
default = false;
description = ''
make sure ssh is only available trough the tinc
'';
};
};
config = mkMerge [
(mkIf cfg.enable {
2024-04-12 22:23:06 +02:00
environment.systemPackages = [
pkgs.sshfs
pkgs.mosh
];
2023-05-28 21:24:20 +02:00
2022-10-13 10:19:23 +02:00
services.openssh = {
enable = true;
2023-06-29 10:08:09 +02:00
settings.X11Forwarding = false;
settings.PasswordAuthentication = false;
2024-07-09 09:48:03 +02:00
# We might want to remove this once, openssh is fixed everywhere:
# Workaround for CVE-2024-6387 and CVE-2024-6409
# https://github.com/NixOS/nixpkgs/pull/323753#issuecomment-2199762128
settings.LoginGraceTime = 0;
2022-10-13 10:19:23 +02:00
};
2023-06-01 11:44:02 +02:00
users.users.root.openssh.authorizedKeys.keyFiles = cfg.rootKeyFiles ++ defaultRootKeyFiles;
2022-10-13 10:19:23 +02:00
2024-05-29 20:16:04 +02:00
# todo enable again when I can it's possible to set the `-q` ssh option in clan
#services.openssh.banner = builtins.readFile sshBanner;
2022-10-13 10:19:23 +02:00
})
2024-04-12 22:23:06 +02:00
(mkIf cfg.sshguard.enable {
environment.systemPackages = [ pkgs.ipset ];
services.sshguard.enable = lib.mkDefault true;
2024-04-16 17:19:20 +02:00
})
2024-04-12 22:23:06 +02:00
2022-10-13 10:19:23 +02:00
(mkIf (cfg.onlyTincAccess && cfg.enable) {
networking.firewall.extraCommands = ''
iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0
'';
})
];
}