chn/nixos
1
0
Fork 0
mirror of https://github.com/CHN-beta/nixos.git synced 2026-01-12 04:19:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

services.sshd: add groupBanner

Browse Source
This commit is contained in:
陈浩南
2024-03-31 14:17:00 +08:00
parent bc368617b9
commit 392433de5a
12 changed files with 78 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
devices/nas/default.nix
View File

@@ -59,7 +59,7 @@ inputs:
hostsAllowed = "192.168. 127.";
shares = { home.path = "/home"; root.path = "/"; };
};
sshd.enable = true;
sshd = {};
xray.client.dae.wanInterface = [ "enp3s0" ];
xrdp = { enable = true; hostname = [ "nas.chn.moe" "office.chn.moe" ]; };
groupshare = {};

2
devices/pc/default.nix
View File

@@ -89,7 +89,7 @@ inputs:
share.path = "/home/chn/share";
};
};
sshd.enable = true;
sshd = {};
xray.client =
{
dnsmasq.hosts = builtins.listToAttrs (builtins.map

2
devices/pi3b/default.nix
View File

@@ -27,7 +27,7 @@ inputs:
services =
{
# snapper.enable = true;
sshd.enable = true;
sshd = {};
xray.client.dae.wanInterface = [ "enu1u1" ];
fail2ban = {};
wireguard =

2
devices/surface/default.nix
View File

@@ -41,7 +41,7 @@ inputs:
{
snapper.enable = true;
fontconfig.enable = true;
sshd.enable = true;
sshd = {};
xray.client.dae.wanInterface = [ "wlp2s0" ];
firewall.trustedInterfaces = [ "virbr0" ];
wireguard =

2
devices/vps6/default.nix
View File

@@ -35,7 +35,7 @@ inputs:
services =
{
snapper.enable = false;
sshd.enable = true;
sshd = {};
xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 14; };
frpServer = { enable = true; serverName = "frp.chn.moe"; };
nginx =

2
devices/vps7/default.nix
View File

@@ -37,7 +37,7 @@ inputs:
{
snapper.enable = true;
fontconfig.enable = true;
sshd.enable = true;
sshd = {};
rsshub.enable = true;
wallabag.enable = true;
misskey.instances =

2
devices/xmupc1/default.nix
View File

@@ -59,7 +59,7 @@ inputs:
{
snapper.enable = true;
fontconfig.enable = true;
sshd = { enable = true; passwordAuthentication = true; };
sshd = { passwordAuthentication = true; groupBanner = true; };
xray.client.dae.wanInterface = [ "wlp57s0" ];
firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
smartd.enable = true;

2
devices/xmupc2/default.nix
View File

@@ -53,7 +53,7 @@ inputs:
{
snapper.enable = true;
fontconfig.enable = true;
sshd = { enable = true; passwordAuthentication = true; };
sshd = { passwordAuthentication = true; groupBanner = true; };
xray.client.dae.wanInterface = [ "wlp4s0" ];
firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
smartd.enable = true;

27
modules/services/sshd.nix
View File

@@ -1,27 +0,0 @@
inputs:
{
options.nixos.services.sshd = let inherit (inputs.lib) mkOption types; in
{
enable = mkOption { type = types.bool; default = false; };
passwordAuthentication = mkOption { type = types.bool; default = false; };
};
config =
let
inherit (inputs.lib) mkIf;
inherit (inputs.config.nixos.services) sshd;
in mkIf sshd.enable
{
services.openssh =
{
enable = true;
settings =
{
X11Forwarding = true;
ChallengeResponseAuthentication = false;
PasswordAuthentication = sshd.passwordAuthentication;
KbdInteractiveAuthentication = false;
UsePAM = true;
};
};
};
}

19
modules/services/sshd/banner-rendered.txt Normal file
View File

@@ -0,0 +1,19 @@
                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓███████▓▒░  
                  ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
                 ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
                ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
               ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
              ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
             ░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

      ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░  
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
   ░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
  ░▒▓█▓▒▒▓███▓▒░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░  
 ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░        
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░        
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░        

               ┌──────────────────────────┐
               │ＩｎＡｌＧａＮ  ／  ＳｉＣ│
               └──────────────────────────┘

19
modules/services/sshd/banner.txt Normal file
View File

@@ -0,0 +1,19 @@
░▒▓█▓▒░ ░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░ ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒▒▓███▓▒░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░
┌──────────────────────────┐
│ＩｎＡｌＧａＮ ／ ＳｉＣ│
└──────────────────────────┘

32
modules/services/sshd/default.nix Normal file
View File

@@ -0,0 +1,32 @@
inputs:
{
options.nixos.services.sshd = let inherit (inputs.lib) mkOption types; in mkOption
{
type = types.nullOr (types.submodule { options =
{
passwordAuthentication = mkOption { type = types.bool; default = false; };
groupBanner = mkOption { type = types.bool; default = false; };
};});
default = null;
};
config = let inherit (inputs.config.nixos.services) sshd; in inputs.lib.mkIf (sshd != null)
{
services.openssh =
{
enable = true;
settings =
{
X11Forwarding = true;
ChallengeResponseAuthentication = false;
PasswordAuthentication = sshd.passwordAuthentication;
KbdInteractiveAuthentication = false;
UsePAM = true;
};
};
# generate from https://patorjk.com/software/taag with font "BlurVision ASCII"
# generate using `toilet -f wideterm -F border "InAlGaN / SiC"`
# somehow lolcat could not run with these characters, use rendered directly
# TODO: move this settings to user
users.motdFile = inputs.lib.mkIf sshd.groupBanner ./banner-rendered.txt;
};
}