ahuston-0/nix-dotfiles
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Fix hostkeys, zfs autoscrub service

Browse Source 
Signed-off-by: ahuston-0 <aliceghuston@gmail.com>
This commit is contained in:
ahuston-0 2023-12-29 11:42:31 -05:00
parent 85cda756b8
commit 774bd99550
2 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
systems/configuration.nix
View File

@ -29,6 +29,22 @@
enable = true;
fixPermissions = true;
extraConfig = ''StreamLocalBindUnlink yes'';
# below is a modified default to include ecdsa (as per this https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67)
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/etc/ssh/ssh_host_ecdsa_key";
type = "ecdsa";
}
];
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
@ -45,7 +61,7 @@
"aes192-ctr"
"aes128-ctr"
];
MACs = [
Macs = [
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
@ -53,22 +69,6 @@
"hmac-sha2-256"
"umac-128@openssh.com"
];
# below is a modified default to include ecdsa (as per this https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67)
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/etc/ssh/ssh_host_ecdsa_key";
type = "ecdsa";
}
];
# below config options from Lynis recommendations
ClientAliveCountMax =2;

2
systems/palatine-hill/configuration.nix
View File

@ -50,7 +50,7 @@
smartd.enable = true;
zfs = {
trim.enable = true;
autoscrub.enable = true;
autoScrub.enable = true;
};
};