SSH - Revision history

DHCP: /* Configuration */ use indented string for programs.ssh.extraConfig

2026-07-19T17:34:10Z

Configuration: use indented string for programs.ssh.extraConfig

← Older revision		Revision as of 17:34, 19 July 2026
Line 44:		Line 44:
	<nowiki>		<nowiki>
	programs.ssh = {		programs.ssh = {
	extraConfig = "		extraConfig = ''
	Host myhost		Host myhost
	Hostname 192.168.1.123		Hostname 192.168.1.123
	Port 22		Port 22
	User user		User user
	";		'';
	};		};
	</nowiki>		</nowiki>

DHCP: fix indentation

2026-07-19T17:30:55Z

fix indentation

← Older revision		Revision as of 17:30, 19 July 2026
Line 17:		Line 17:
	{{file\|/etc/nixos/configuration.nix\|nix\|		{{file\|/etc/nixos/configuration.nix\|nix\|
	<nowiki>		<nowiki>
	services.openssh = {		services.openssh = {
	enable = true;		enable = true;
	openFirewall = true;		openFirewall = true;
	settings = {		settings = {
	PasswordAuthentication = false;		PasswordAuthentication = false;
	KbdInteractiveAuthentication = false;		KbdInteractiveAuthentication = false;
	PermitRootLogin = "no";		PermitRootLogin = "no";
	AllowUsers = [ "myUser" ];		AllowUsers = [ "myUser" ];
	MaxAuthTries = 3;		MaxAuthTries = 3;
	PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";		PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
	};
	};		};
			};
	</nowiki>		</nowiki>
	\|name=/etc/nixos/configuration.nix\|lang=nix}}		\|name=/etc/nixos/configuration.nix\|lang=nix}}
Line 43:		Line 43:
	{{file\|/etc/nixos/configuration.nix\|nix\|		{{file\|/etc/nixos/configuration.nix\|nix\|
	<nowiki>		<nowiki>
	programs.ssh = {		programs.ssh = {
	extraConfig = "		extraConfig = "
	Host myhost		Host myhost
	Hostname 192.168.1.123		Hostname 192.168.1.123
	Port 22		Port 22
	User user		User user
	";		";
	};		};
	</nowiki>		</nowiki>
	}}		}}

D1j1t: Fixed typo in "Client"

2026-05-31T15:16:41Z

Fixed typo in "Client"

← Older revision		Revision as of 15:16, 31 May 2026
Line 36:		Line 36:
	For more SSH server configuration options, refer to the {{nixos:option\|services.openssh}} module options.		For more SSH server configuration options, refer to the {{nixos:option\|services.openssh}} module options.

	== ~~Cliet~~ ==		== Client ==

	=== Configuration ===		=== Configuration ===

Onny: Simplify and cleanup page

2026-05-31T06:41:01Z

Simplify and cleanup page

@@ Line 10: / Line 10: @@
 Take the time to comprehend the implications of your actions and ensure that any changes made are done thoughtfully and with care.}}
-= OpenSSH Server =
+== Server ==
 To enable a SSH service, add the following to your system configuration:
@@ Line 18: / Line 19: @@
    services.openssh = {
      enable = true;
-  };
+     openFirewall = true;
      settings = {
        PasswordAuthentication = false;
@@ Line 50: / Line 25: @@
        PermitRootLogin = "no";
        AllowUsers = [ "myUser" ];
      };
    };
@@ Line 55: / Line 32: @@
 |name=/etc/nixos/configuration.nix|lang=nix}}
-In addition to these settings, consider enabling [[#Fail2Ban|Fail2Ban]] as a recommended baseline for security. Alternatively, you can make use of '''PerSourcePenalties''' introduced with OpenSSH 9.8<ref>https://text.tchncs.de/senioradmin/are-you-still-banning-or-do-you-already-penalize</ref>:
+The example restricts authentication only to the user defined in <code>settings.AllowUsers</code> by using [[SSH public key authentication|public key authentication]]. By default, the server listens on port 22. For further security, the default listenig port should be changed using the <code>ports</code> option.
-{{file|/etc/nixos/configuration.nix|nix|
+For more SSH server configuration options, refer to the {{nixos:option|services.openssh}} module options.
-= SSH client configuration =
+== Cliet ==
 The OpenSSH client is available by default on NixOS and can be configured using the {{nixos:option|programs.ssh}} module options.
@@ Line 94: / Line 65: @@
 Alternatively, you can manually manage SSH client configuration by placing entries in the user-specific <code>~/.ssh/config</code> file.
 [[Category:Networking]]
 [[Category:Server]]

Woile: update styling

2026-05-25T07:22:16Z

update styling

← Older revision		Revision as of 07:22, 25 May 2026
Line 53:		Line 53:
	};		};
	</nowiki>		</nowiki>
	\|name=\|lang=}}		\|name=/etc/nixos/configuration.nix\|lang=nix}}

	In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security. Alternatively, you can make use of '''PerSourcePenalties''' introduced with OpenSSH 9.8<ref>https://text.tchncs.de/senioradmin/are-you-still-banning-or-do-you-already-penalize</ref>:		In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security. Alternatively, you can make use of '''PerSourcePenalties''' introduced with OpenSSH 9.8<ref>https://text.tchncs.de/senioradmin/are-you-still-banning-or-do-you-already-penalize</ref>:
Line 64:		Line 64:
	};		};
	</nowiki>		</nowiki>
	\|name=\|lang=}}		\|name=/etc/nixos/configuration.nix\|lang=nix}}

	= SSH client configuration =		= SSH client configuration =

Arnecc: added info on PerSourcePenalties

2026-04-13T16:13:06Z

added info on PerSourcePenalties

← Older revision		Revision as of 16:13, 13 April 2026
Line 55:		Line 55:
	\|name=\|lang=}}		\|name=\|lang=}}

	In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security.		In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security. Alternatively, you can make use of '''PerSourcePenalties''' introduced with OpenSSH 9.8<ref>https://text.tchncs.de/senioradmin/are-you-still-banning-or-do-you-already-penalize</ref>:

			{{file\|/etc/nixos/configuration.nix\|nix\|
			<nowiki>
			services.openssh = {
			[...]
			extraConfig = "MaxAuthTries 3 \n PerSourcePenalties crash:3600s authfail:3600s max:86400s";
			};
			</nowiki>
			\|name=\|lang=}}

	= SSH client configuration =		= SSH client configuration =

Oluceps: /* Security hardening */

2025-07-27T13:03:39Z

Security hardening

← Older revision		Revision as of 13:03, 27 July 2025
Line 44:		Line 44:
	services.openssh = {		services.openssh = {
	enable = true;		enable = true;
	~~Ports~~ = [ 5432 ];		ports = [ 5432 ];
	settings = {		settings = {
	PasswordAuthentication = false;		PasswordAuthentication = false;

Jnalley: Added missing semicolon

2025-07-26T20:34:02Z

Added missing semicolon

← Older revision		Revision as of 20:34, 26 July 2025
Line 49:		Line 49:
	KbdInteractiveAuthentication = false;		KbdInteractiveAuthentication = false;
	PermitRootLogin = "no";		PermitRootLogin = "no";
	AllowUsers = [ "myUser" ]		AllowUsers = [ "myUser" ];
	};		};
	};		};
	</nowiki>		</nowiki>
	}}		\|name=\|lang=}}

	In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security.		In addition to these settings, consider enabling [[#Fail2Ban\|Fail2Ban]] as a recommended baseline for security.

Pigs: Create ssh page, detail server and client configuration

2025-05-13T17:04:20Z

Create ssh page, detail server and client configuration

New page

[https://en.wikipedia.org/wiki/Secure_Shell SSH (Secure Shell)] is a protocol for securely accessing remote machines over an unsecured network. It is commonly used for remote administration, file transfers, and secure tunneling.

This page covers the setup and management of SSH on NixOS systems. NixOS primarily uses [https://www.openssh.com/ OpenSSH] for both server and client functionality.

For more manual-level information, refer to the {{NixOS Manual|name=NixOS Manual: Chapter - Secure Shell Access|anchor=#sec-ssh}}.

{{Security Warning|Changing SSH configuration settings can significantly impact the security of your system(s). It is crucial to have a solid understanding of what you are doing before making any adjustments.

Avoid blindly copying and pasting examples, including those from this Wiki page, without conducting a thorough analysis. Failure to do so may compromise the security of your system(s) and lead to potential vulnerabilities.
Take the time to comprehend the implications of your actions and ensure that any changes made are done thoughtfully and with care.}}

= OpenSSH Server =

To enable a SSH service, add the following to your system configuration:

{{file|/etc/nixos/configuration.nix|nix|
<nowiki>
services.openssh = {
enable = true;
};
</nowiki>
}}

By default, the server listens on port 22 and allows password authentication. Note that the port defined in the <code>openssh</code> config is opened automatically in the [[Firewall|firewall]].

For more SSH server configuration options, refer to the {{nixos:option|services.openssh}} module options.

== Security hardening ==

To improve the security of your SSH server, it is recommended to apply the following measures:

* Disable password-based login

* Disable root login

* Restrict allowed users

* Change the default port

These options can be configured declaratively in your system configuration:

{{file|/etc/nixos/configuration.nix|nix|
<nowiki>
services.openssh = {
enable = true;
Ports = [ 5432 ];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
AllowUsers = [ "myUser" ]
};
};
</nowiki>
}}

In addition to these settings, consider enabling [[#Fail2Ban|Fail2Ban]] as a recommended baseline for security.

= SSH client configuration =

The OpenSSH client is available by default on NixOS and can be configured using the {{nixos:option|programs.ssh}} module options.

{{file|/etc/nixos/configuration.nix|nix|
<nowiki>
programs.ssh = {
extraConfig = "
Host myhost
Hostname 192.168.1.123
Port 22
User user
";
};
</nowiki>
}}

This allows you to connect using:

<syntaxhighlight lang="console">
$ ssh myhost
</syntaxhighlight>

{{note|Since this is a system-wide configuration, you cannot specify a user-specific identity file here due to file permission constraints.}}

For per-user SSH configuration, consider using [[Home Manager]] with the [https://home-manager-options.extranix.com/?query=programs.ssh programs.ssh] options, which allow for more flexible, user-level SSH client settings.

Alternatively, you can manually manage SSH client configuration by placing entries in the user-specific <code>~/.ssh/config</code> file.

= SSH public key authentication =

For details on configuring public key authentication, managing SSH keys, and setting up SSH agents, see the dedicated page: [[SSH public key authentication]].

= Tips and tricks =

== Fail2Ban ==

{{main|Fail2ban}}

[http://www.fail2ban.org/ Fail2Ban] is a service that bans hosts that cause multiple authentication errors.

To enable Fail2Ban, add the following to your system configuration:

{{file|/etc/nixos/configuration.nix|nix|
<nowiki>
services.fail2ban.enable = true;
</nowiki>
}}

== Endlessh ==

[https://github.com/skeeto/endlessh Endlessh] is a SSH tarpit that slows down malicious or automated SSH connection attempts by indefinitely delaying connections.

To enable Endlessh, add the following to your system configuration:

{{file|/etc/nixos/configuration.nix|nix|
<nowiki>
services.endlessh = {
enable = true;
port = 22;
openFirewall = true;
};
</nowiki>
}}

For additional configuration options, see the{{nixos:option|services.endlessh}} module documentation.

= See also =

* [[SSH public key authentication]]
* [[Fail2ban]]

[[Category:Networking]]
[[Category:Server]]