From 83ca6290a283b500ff029b58b5d4aa40210f6abf Mon Sep 17 00:00:00 2001
From: Christoph Cullmann <cullmann@kde.org>
Date: Fri, 29 Dec 2023 12:08:50 +0100
Subject: [PATCH] more sane ssh settings, see
 https://github.com/jtesta/ssh-audit

---
 common.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/common.nix b/common.nix
index 6e45b03..a698008 100644
--- a/common.nix
+++ b/common.nix
@@ -83,7 +83,12 @@ in
     hostKeys = [{
       path = "/nix/persistent/ssh_host_ed25519_key";
       type = "ed25519";
-    }];
+    }];;
+
+    # only safe ciphers & Co.
+    settings.Ciphers = [ "aes256-gcm@openssh.com" ];
+    settings.KexAlgorithms = [ "sntrup761x25519-sha512@openssh.com" ];
+    settings.Macs = [ "hmac-sha2-512-etm@openssh.com" ];
   };
 
   # guard the ssh service