75 lines
2.2 KiB
Nix
75 lines
2.2 KiB
Nix
{ pkgs, ... }:
|
|
let
|
|
port = 22222;
|
|
stateDir = "/var/lib/experimental-sshd";
|
|
configFile = pkgs.writeText "experimental-sshd_config" ''
|
|
Port 22222
|
|
ListenAddress 0.0.0.0
|
|
ListenAddress ::
|
|
|
|
HostKey ${stateDir}/ssh_host_ed25519_key
|
|
HostKey ${stateDir}/ssh_host_rsa_key
|
|
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PubkeyAuthentication yes
|
|
PermitRootLogin prohibit-password
|
|
UsePAM yes
|
|
AuthenticationMethods publickey
|
|
AuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u
|
|
LogLevel DEBUG3
|
|
|
|
VersionAddendum none
|
|
HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519
|
|
KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256
|
|
Ciphers aes256-ctr,aes128-ctr
|
|
MACs hmac-sha2-512,hmac-sha2-256
|
|
'';
|
|
|
|
keygenScript = pkgs.writeShellScript "experimental-sshd-keygen" ''
|
|
set -eu
|
|
|
|
${pkgs.coreutils}/bin/mkdir -p -m 0700 ${stateDir}
|
|
|
|
if [ ! -f ${stateDir}/ssh_host_ed25519_key ]; then
|
|
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f ${stateDir}/ssh_host_ed25519_key -N ""
|
|
fi
|
|
|
|
if [ ! -f ${stateDir}/ssh_host_rsa_key ]; then
|
|
${pkgs.openssh}/bin/ssh-keygen -t rsa -b 4096 -f ${stateDir}/ssh_host_rsa_key -N ""
|
|
fi
|
|
'';
|
|
in
|
|
{
|
|
environment.etc."ssh/experimental-sshd_config".source = configFile;
|
|
|
|
networking.firewall.allowedTCPPorts = [ port ];
|
|
|
|
systemd.services.experimental-sshd-keygen = {
|
|
description = "Generate experimental SSH host keys";
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
StateDirectory = "experimental-sshd";
|
|
ExecStart = keygenScript;
|
|
};
|
|
};
|
|
|
|
systemd.services.experimental-sshd = {
|
|
description = "Experimental SSH daemon";
|
|
wantedBy = [ "multi-user.target" ];
|
|
wants = [ "experimental-sshd-keygen.service" ];
|
|
after = [ "network.target" "experimental-sshd-keygen.service" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
StateDirectory = "experimental-sshd";
|
|
RuntimeDirectory = "experimental-sshd";
|
|
ExecStart = "${pkgs.openssh}/bin/sshd -D -e -f /etc/ssh/experimental-sshd_config";
|
|
};
|
|
preStart = ''
|
|
${pkgs.openssh}/bin/sshd -t -f /etc/ssh/experimental-sshd_config
|
|
'';
|
|
};
|
|
}
|