From 65ee1a001f3df4ef5ef6871d98bf797f86da9914 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Wed, 26 Aug 2026 17:42:19 +0800
Subject: [PATCH] security: disable SSH X11 forwarding on servers, keep on
 desktops

---
 modules/nixos/base/ssh.nix                                | 4 +++-
 modules/nixos/desktop/ssh.nix                             | 5 +++++
 outputs/aarch64-linux/tests/security-ssh-x11/expected.nix | 7 +++++++
 outputs/aarch64-linux/tests/security-ssh-x11/expr.nix     | 7 +++++++
 outputs/x86_64-linux/tests/security-ssh-x11/expected.nix  | 7 +++++++
 outputs/x86_64-linux/tests/security-ssh-x11/expr.nix      | 7 +++++++
 6 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 modules/nixos/desktop/ssh.nix
 create mode 100644 outputs/aarch64-linux/tests/security-ssh-x11/expected.nix
 create mode 100644 outputs/aarch64-linux/tests/security-ssh-x11/expr.nix
 create mode 100644 outputs/x86_64-linux/tests/security-ssh-x11/expected.nix
 create mode 100644 outputs/x86_64-linux/tests/security-ssh-x11/expr.nix

diff --git a/modules/nixos/base/ssh.nix b/modules/nixos/base/ssh.nix
index e32ec737..d5b0517d 100644
--- a/modules/nixos/base/ssh.nix
+++ b/modules/nixos/base/ssh.nix
@@ -7,7 +7,9 @@
   services.openssh = {
     enable = true;
     settings = {
-      X11Forwarding = true;
+      # Secure by default: X11 forwarding off everywhere; desktops re-enable it
+      # in modules/nixos/desktop/ssh.nix (needed for GUI forwarding).
+      X11Forwarding = lib.mkDefault false;
       # root user is used for remote deployment, so we need to allow it
       PermitRootLogin = "prohibit-password";
       PasswordAuthentication = false; # disable password login
diff --git a/modules/nixos/desktop/ssh.nix b/modules/nixos/desktop/ssh.nix
new file mode 100644
index 00000000..5e000e1d
--- /dev/null
+++ b/modules/nixos/desktop/ssh.nix
@@ -0,0 +1,5 @@
+{
+  # Desktops keep X11 forwarding (current behavior, needed for GUI forwarding);
+  # servers default to off (see modules/nixos/base/ssh.nix).
+  services.openssh.settings.X11Forwarding = true;
+}
diff --git a/outputs/aarch64-linux/tests/security-ssh-x11/expected.nix b/outputs/aarch64-linux/tests/security-ssh-x11/expected.nix
new file mode 100644
index 00000000..6ca2c34e
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-ssh-x11/expected.nix
@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: name == "ai-niri" || name == "shoukei-niri"
+)
diff --git a/outputs/aarch64-linux/tests/security-ssh-x11/expr.nix b/outputs/aarch64-linux/tests/security-ssh-x11/expr.nix
new file mode 100644
index 00000000..5905f493
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-ssh-x11/expr.nix
@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+)
diff --git a/outputs/x86_64-linux/tests/security-ssh-x11/expected.nix b/outputs/x86_64-linux/tests/security-ssh-x11/expected.nix
new file mode 100644
index 00000000..6ca2c34e
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-ssh-x11/expected.nix
@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: name == "ai-niri" || name == "shoukei-niri"
+)
diff --git a/outputs/x86_64-linux/tests/security-ssh-x11/expr.nix b/outputs/x86_64-linux/tests/security-ssh-x11/expr.nix
new file mode 100644
index 00000000..5905f493
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-ssh-x11/expr.nix
@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+)