starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-27 13:54:03 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

security: disable SSH X11 forwarding on servers, keep on desktops

Browse Source
This commit is contained in:
Ryan Yin
2026-08-26 18:14:43 +08:00
parent 212f45e2ca
commit 65ee1a001f
6 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nixos/base/ssh.nix
+3 -1
View File
@@ -7,7 +7,9 @@
services.openssh = {
enable = true;
settings = {
X11Forwarding = true;
# Secure by default: X11 forwarding off everywhere; desktops re-enable it
# in modules/nixos/desktop/ssh.nix (needed for GUI forwarding).
X11Forwarding = lib.mkDefault false;
# root user is used for remote deployment, so we need to allow it
PermitRootLogin = "prohibit-password";
PasswordAuthentication = false; # disable password login