fix(security): tighten desktop remote access

2026-09-10 20:11:47 +02:00 · 2026-09-01 20:20:51 +08:00
parent 13436c0c31
commit f766dcc24f
9 changed files with 39 additions and 12 deletions
@@ -1,5 +1,8 @@
 {
  # Desktops keep X11 forwarding (current behavior, needed for GUI forwarding);
  # servers default to off (see modules/nixos/base/ssh.nix).
-  services.openssh.settings.X11Forwarding = true;
+  services.openssh.settings = {
+    PermitRootLogin = "no";
+    X11Forwarding = true;
+  };
 }