SSH

SSH (Secure Shell) is a protocol for securely accessing remote machines over an unsecured network. It is commonly used for remote administration, file transfers, and secure tunneling.

This page covers the setup and management of SSH on NixOS systems. NixOS primarily uses OpenSSH for both server and client functionality.

For more manual-level information, refer to the NixOS Manual: Chapter - Secure Shell Access.

🛡︎︎

Security information: Changing SSH configuration settings can significantly impact the security of your system(s). It is crucial to have a solid understanding of what you are doing before making any adjustments.

Avoid blindly copying and pasting examples, including those from this Wiki page, without conducting a thorough analysis. Failure to do so may compromise the security of your system(s) and lead to potential vulnerabilities. Take the time to comprehend the implications of your actions and ensure that any changes made are done thoughtfully and with care.

Server

Setup

To enable a SSH service, add the following to your system configuration:

❄︎ /etc/nixos/configuration.nix

services.openssh = {
  enable = true;
  openFirewall = true;
  settings = {
    PasswordAuthentication = false;
    KbdInteractiveAuthentication = false;
    PermitRootLogin = "no";
    AllowUsers = [ "myUser" ];
    MaxAuthTries = 3;
    PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
  };
};

The example restricts authentication only to the user defined in settings.AllowUsers by using public key authentication. By default, the server listens on port 22. For further security, the default listenig port should be changed using the ports option.

For more SSH server configuration options, refer to the services.openssh module options.

Client

Configuration

The OpenSSH client is available by default on NixOS and can be configured using the programs.ssh module options.

❄︎ /etc/nixos/configuration.nix

programs.ssh = {
  extraConfig = ''
    Host myhost
      Hostname 192.168.1.123
      Port 22
      User user
  '';
};

This allows you to connect using:

$ ssh myhost

Note: Since this is a system-wide configuration, you cannot specify a user-specific identity file here due to file permission constraints.

For per-user SSH configuration, consider using Home Manager with the programs.ssh options, which allow for more flexible, user-level SSH client settings.

Alternatively, you can manually manage SSH client configuration by placing entries in the user-specific ~/.ssh/config file.