30 lines
1.6 KiB
Nix
30 lines
1.6 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
users.users."grey".openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
enableRecommendedAlgorithms = false;
|
|
generateHostKeys = false;
|
|
settings = {
|
|
AllowUsers = [ "grey" ];
|
|
KbdInteractiveAuthentication = false;
|
|
PasswordAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
MaxAuthTries = 3;
|
|
MaxSessions = 5;
|
|
MaxStartups = "2:50:5";
|
|
};
|
|
startWhenNeeded = true;
|
|
};
|
|
|
|
networking.firewall.extraCommands = ''
|
|
if [ "$(iptables -S INPUT)" != "-P INPUT ACCEPT" ]; then iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP; ${pkgs.ipset}/bin/ipset destroy geo-whitelist; fi
|
|
${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
|
|
iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
|
|
'';
|
|
}
|