koi.rip / dotfiles
my nixos dotfiles :3 (git.koi.rip mirror) git.koi.rip/koi/dotfiles
linux dotfiles neovim nixos catppuccin
fork atom

base: update SSH security

koi.rip 6ac970af db25b76a

+1 -5
unified split
-5
modules/base/networking.nix
··· 42 for ip in "''${v6blocklist[@]}"; do 43 ensure_rule6 -s "$ip" -j DROP 44 done 45 - 46 - ensure_rule -p tcp --dport 22 -m conntrack --ctstate NEW \ 47 - -m recent --name SSH --rsource --update --seconds 120 --hitcount 10 -j DROP 48 - ensure_rule -p tcp --dport 22 -m conntrack --ctstate NEW \ 49 - -m recent --name SSH --rsource --set 50 ''; 51 }; 52 };
··· 42 for ip in "''${v6blocklist[@]}"; do 43 ensure_rule6 -s "$ip" -j DROP 44 done 45 ''; 46 }; 47 };
+1
modules/base/services/openssh.nix
··· 3 enable = true; 4 openFirewall = true; 5 settings = { 6 PubkeyAuthentication = true; 7 PasswordAuthentication = false; 8 KbdInteractiveAuthentication = false;
··· 3 enable = true; 4 openFirewall = true; 5 settings = { 6 + LogLevel = "ERROR"; # haxerz OUT 7 PubkeyAuthentication = true; 8 PasswordAuthentication = false; 9 KbdInteractiveAuthentication = false;