b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

openssh: support prohibit-password for permitRootLogin

Browse source 
See 1dc8d93ce6

I also made it the default.
This commit is contained in:
Anmol Sethi 2016-10-01 13:23:56 -04:00
parent 98a8146428
commit 6891bb1c59
No known key found for this signature in database
GPG key ID: 427400A70839B0ED
6 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nixos/modules/services/networking/ssh/sshd.nix
View file

@ -102,8 +102,8 @@ in
};
permitRootLogin = mkOption {
default = "without-password";
type = types.enum ["yes" "without-password" "forced-commands-only" "no"];
default = "prohibit-password";
type = types.enum ["yes" "without-password" "prohibit-password" "forced-commands-only" "no"];
description = ''
Whether the root user can login using ssh.
'';

2
nixos/modules/virtualisation/amazon-image.nix
View file

@ -138,7 +138,7 @@ let cfg = config.ec2; in
# Allow root logins only using the SSH key that the user specified
# at instance creation time.
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.permitRootLogin = "prohibit-password";
# Force getting the hostname from EC2.
networking.hostName = mkDefault "";

2
nixos/modules/virtualisation/azure-common.nix
View file

@ -24,7 +24,7 @@ with lib;
# Allow root logins only using the SSH key that the user specified
# at instance creation time, ping client connections to avoid timeouts
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.permitRootLogin = "prohibit-password";
services.openssh.extraConfig = ''
ClientAliveInterval 180
'';

2
nixos/modules/virtualisation/brightbox-image.nix
View file

@ -103,7 +103,7 @@ in
# Allow root logins only using the SSH key that the user specified
# at instance creation time.
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.permitRootLogin = "prohibit-password";
# Force getting the hostname from Google Compute.
networking.hostName = mkDefault "";

2
nixos/modules/virtualisation/google-compute-image.nix
View file

@ -111,7 +111,7 @@ in
# Allow root logins only using the SSH key that the user specified
# at instance creation time.
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.permitRootLogin = "prohibit-password";
services.openssh.passwordAuthentication = mkDefault false;
# Force getting the hostname from Google Compute.

2
nixos/modules/virtualisation/nova-image.nix
View file

@ -31,7 +31,7 @@ with lib;
# Allow root logins
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.permitRootLogin = "prohibit-password";
# Put /tmp and /var on /ephemeral0, which has a lot more space.
# Unfortunately we can't do this with the `fileSystems' option