diff options
| -rw-r--r-- | modules/services/openssh.nix | 127 |
1 files changed, 65 insertions, 62 deletions
diff --git a/modules/services/openssh.nix b/modules/services/openssh.nix index 5775ca8..c34ebd3 100644 --- a/modules/services/openssh.nix +++ b/modules/services/openssh.nix @@ -1,10 +1,6 @@ { flake.modules.nixos.openssh = - { - lib, - pkgs, - ... - }: + { lib, pkgs, ... }: { services.openssh = { enable = true; @@ -17,20 +13,19 @@ PermitRootLogin = "yes"; }; }; + networking.firewall.allowedTCPPorts = [ 8693 ]; services.fail2ban = { enable = true; bantime = lib.mkDefault "1h"; - jails = { - sshd = { - enabled = true; - settings = { - port = 8693; - backend = "systemd"; - maxretry = 4; - findtime = "10m"; - }; + jails.sshd = { + enabled = true; + settings = { + port = 8693; + backend = "systemd"; + maxretry = 4; + findtime = "10m"; }; }; }; @@ -38,55 +33,63 @@ security.pam.services.sshd.text = lib.mkDefault ( lib.mkAfter '' session optional pam_exec.so ${pkgs.writeShellScript "ssh-login-notify" '' - if [ "$PAM_TYPE" = "open_session" ]; then - TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") - HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) - - ( - ${pkgs.coreutils}/bin/echo "To: leander@schererleander.de" - ${pkgs.coreutils}/bin/echo "From: root@sachiel.schererleander.de" - ${pkgs.coreutils}/bin/echo "Subject: SSH Login Alert: $PAM_USER" - ${pkgs.coreutils}/bin/echo "Content-Type: text/html; charset=UTF-8" - ${pkgs.coreutils}/bin/echo "" - ${pkgs.coreutils}/bin/cat <<EOF - <!DOCTYPE html> - <html> - <head> - <meta name="color-scheme" content="light dark"> - <style> - :root { color-scheme: light dark; } - body { font-family: sans-serif; line-height: 1.5; color: #000; background: #fff; max-width: 800px; margin: 0 auto; padding: 20px; } - h1 { border-bottom: 2px solid #000; color: #d97706; } - table { width: 100%; border-collapse: collapse; margin-bottom: 15px; font-size: 13px; } - th, td { text-align: left; padding: 6px; border-bottom: 1px solid #ddd; } - a { color: #0066cc; } - @media (prefers-color-scheme: dark) { - body { background: #121212; color: #eee; } - h1, th { border-color: #555; } - h1 { color: #f59e0b; } - th, td { border-color: #333; } - a { color: #66b3ff; } - } - </style> - </head> - <body> - <h1>SSH Login Alert</h1> - - <p>A successful SSH login was just detected.</p> + if [ "$PAM_TYPE" = "open_session" ]; then + TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") + HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) + + { + ${pkgs.coreutils}/bin/printf '%s\n' \ + "To: leander@schererleander.de" \ + "From: root@sachiel.schererleander.de" \ + "Subject: SSH login: $PAM_USER from $PAM_RHOST" \ + "Content-Type: text/html; charset=UTF-8" \ + "" + + ${pkgs.coreutils}/bin/cat <<EOF + <!doctype html> + <html> + <head> + <meta name="color-scheme" content="light dark"> + <meta name="supported-color-schemes" content="light dark"> + <style> + :root { color-scheme: light dark; } + body { margin: 0; padding: 20px; font: 14px sans-serif; background: #fff; color: #111; } + main { max-width: 600px; margin: auto; } + h1 { margin-top: 0; font-size: 22px; } + table { width: 100%; border-collapse: collapse; } + th, td { padding: 6px; text-align: left; border-bottom: 1px solid #ddd; } + th { width: 80px; } + a { color: #06c; } - <table> - <tr><th>User</th><td>$PAM_USER</td></tr> - <tr><th>Host</th><td>$HOSTNAME</td></tr> - <tr><th>Time</th><td>$TIMESTAMP</td></tr> - <tr><th>IP Address</th><td><a href="https://iplookup.flagfox.net/?ip=$PAM_RHOST">$PAM_RHOST</a></td></tr> - <tr><th>Service</th><td>$PAM_SERVICE</td></tr> - <tr><th>TTY</th><td>$PAM_TTY</td></tr> - </table> - </body> - </html> - EOF - ) | /run/wrappers/bin/sendmail -f root@sachiel.schererleander.de leander@schererleander.de - fi + @media (prefers-color-scheme: dark) { + body { background: #121212; color: #eee; } + th, td { border-color: #333; } + a { color: #6bf; } + } + </style> + </head> + <body> + <main> + <h1>SSH Login</h1> + <table> + <tr><th>User</th><td>$PAM_USER</td></tr> + <tr><th>Host</th><td>$HOSTNAME</td></tr> + <tr><th>Time</th><td>$TIMESTAMP</td></tr> + <tr> + <th>IP</th> + <td> + <a href="https://iplookup.flagfox.net/?ip=$PAM_RHOST">$PAM_RHOST</a> + </td> + </tr> + </table> + </main> + </body> + </html> +EOF + } | /run/wrappers/bin/sendmail \ + -f root@sachiel.schererleander.de \ + leander@schererleander.de + fi ''} '' ); |