ahuston-0/nix-dotfiles
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Fix hostkeys, zfs autoscrub service

Browse Source 
Signed-off-by: ahuston-0 <aliceghuston@gmail.com>
This commit is contained in:
ahuston-0 2023-12-29 11:42:31 -05:00
parent 85cda756b8
commit 774bd99550
2 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
systems/configuration.nix
View File

@ -29,6 +29,22 @@
enable = true; enable = true;
fixPermissions = true; fixPermissions = true;
extraConfig = ''StreamLocalBindUnlink yes''; extraConfig = ''StreamLocalBindUnlink yes'';
# below is a modified default to include ecdsa (as per this https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67)
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/etc/ssh/ssh_host_ecdsa_key";
type = "ecdsa";
}
];
settings = { settings = {
PermitRootLogin = "no"; PermitRootLogin = "no";
PasswordAuthentication = false; PasswordAuthentication = false;
@ -45,7 +61,7 @@
"aes192-ctr" "aes192-ctr"
"aes128-ctr" "aes128-ctr"
]; ];
MACs = [ Macs = [
"hmac-sha2-512-etm@openssh.com" "hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com" "hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com" "umac-128-etm@openssh.com"
@ -53,22 +69,6 @@
"hmac-sha2-256" "hmac-sha2-256"
"umac-128@openssh.com" "umac-128@openssh.com"
]; ];
# below is a modified default to include ecdsa (as per this https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67)
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/etc/ssh/ssh_host_ecdsa_key";
type = "ecdsa";
}
];
# below config options from Lynis recommendations # below config options from Lynis recommendations
ClientAliveCountMax =2; ClientAliveCountMax =2;

2
systems/palatine-hill/configuration.nix
View File

@ -50,7 +50,7 @@
smartd.enable = true; smartd.enable = true;
zfs = { zfs = {
trim.enable = true; trim.enable = true;
autoscrub.enable = true; autoScrub.enable = true;
}; };
}; };