-5

modules/base/networking.nix

reviewed

··· 42 42 for ip in "''${v6blocklist[@]}"; do 43 43 ensure_rule6 -s "$ip" -j DROP 44 44 done 45 45 - 46 46 - ensure_rule -p tcp --dport 22 -m conntrack --ctstate NEW \ 47 47 - -m recent --name SSH --rsource --update --seconds 120 --hitcount 10 -j DROP 48 48 - ensure_rule -p tcp --dport 22 -m conntrack --ctstate NEW \ 49 49 - -m recent --name SSH --rsource --set 50 45 ''; 51 46 }; 52 47 };

+1

modules/base/services/openssh.nix

reviewed

··· 3 3 enable = true; 4 4 openFirewall = true; 5 5 settings = { 6 6 + LogLevel = "ERROR"; # haxerz OUT 6 7 PubkeyAuthentication = true; 7 8 PasswordAuthentication = false; 8 9 KbdInteractiveAuthentication = false;