refactor(luna): only permit secure KexAlgos in ssh

2023-10-28 00:34:31 -05:00 · 2023-10-28 00:34:31 -05:00 · 6cb32faa8c
commit 6cb32faa8c
parent 1d500bac80
1 changed files with 7 additions and 0 deletions
--- a/hosts/luna/modules/services/openssh.nix
+++ b/hosts/luna/modules/services/openssh.nix
@ -5,6 +5,13 @@
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "prohibit-password";
+      KexAlgorithms = [
+        "curve25519-sha256"
+        "curve25519-sha256@libssh.org"
+        "diffie-hellman-group16-sha512"
+        "diffie-hellman-group18-sha512"
+        "sntrup761x25519-sha512@openssh.com"
+      ];
    };
    ports = [
      2200