gwg313/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add ssh guard

Browse source
This commit is contained in:
gwg313 2024-02-04 12:52:53 -05:00
parent 1b98ea698d
commit d655186dc0
Signed by: gwg313
GPG key ID: 60FF63B4826B7400
5 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
common/nixos/ssh_guard.nix Normal file
View file

@ -0,0 +1,12 @@
{...}: {
services.sshguard = {
enable = true;
services = [
"sshd"
];
blocktime = 120;
detection_time = 1800;
blacklist_threshold = 120;
blacklist_file = "/var/lib/sshguard/blacklist.db";
};
}

2
hosts/candlekeep/configuration.nix
View file

@ -20,6 +20,7 @@
../../common/nixos/restic.nix ../../common/nixos/restic.nix
../../common/nixos/ssh.nix ../../common/nixos/ssh.nix
../../common/nixos/ssh_client.nix ../../common/nixos/ssh_client.nix
../../common/nixos/ssh_guard.nix
../../common/gui/hyprland.nix ../../common/gui/hyprland.nix
../../common/gui/thunar.nix ../../common/gui/thunar.nix
../../common/style/stylix.nix ../../common/style/stylix.nix
@ -30,6 +31,7 @@
./auditd.nix ./auditd.nix
./kernel.nix ./kernel.nix
./sysctl.nix
./earlyoom.nix ./earlyoom.nix
# Or modules from other flakes (such as nixos-hardware): # Or modules from other flakes (such as nixos-hardware):

7
hosts/candlekeep/sysctl.nix Normal file
View file

@ -0,0 +1,7 @@
{lib, ...}: {
boot.kernel.sysctl = {
# disable unprivileged user namespaces to decrease attack surface
# Enabled because breaks discord/element etc
"kernel.unprivileged_userns_clone" = lib.mkForce 1;
};
}

2
hosts/grymforge/configuration.nix
View file

@ -19,6 +19,7 @@
../../common/nixos/restic.nix ../../common/nixos/restic.nix
../../common/nixos/ssh.nix ../../common/nixos/ssh.nix
../../common/nixos/ssh_client.nix ../../common/nixos/ssh_client.nix
../../common/nixos/ssh_guard.nix
../../common/gui/hyprland.nix ../../common/gui/hyprland.nix
../../common/gui/thunar.nix ../../common/gui/thunar.nix
../../common/style/stylix.nix ../../common/style/stylix.nix
@ -29,6 +30,7 @@
./auditd.nix ./auditd.nix
./kernel.nix ./kernel.nix
./sysctl.nix
./earlyoom.nix ./earlyoom.nix
# Or modules from other flakes (such as nixos-hardware): # Or modules from other flakes (such as nixos-hardware):

7
hosts/grymforge/sysctl.nix Normal file
View file

@ -0,0 +1,7 @@
{lib, ...}: {
boot.kernel.sysctl = {
# disable unprivileged user namespaces to decrease attack surface
# Enabled because breaks discord/element etc
"kernel.unprivileged_userns_clone" = lib.mkForce 1;
};
}