From ea6b456755f798e56fc1f05ce83ecba4e7448dbd Mon Sep 17 00:00:00 2001 From: schererleander Date: Sat, 25 Jul 2026 22:27:02 +0200 Subject: refactor(openssh): simplify login notification email --- modules/services/openssh.nix | 127 ++++++++++++++++++++++--------------------- 1 file changed, 65 insertions(+), 62 deletions(-) (limited to 'modules') diff --git a/modules/services/openssh.nix b/modules/services/openssh.nix index 5775ca8..c34ebd3 100644 --- a/modules/services/openssh.nix +++ b/modules/services/openssh.nix @@ -1,10 +1,6 @@ { flake.modules.nixos.openssh = - { - lib, - pkgs, - ... - }: + { lib, pkgs, ... }: { services.openssh = { enable = true; @@ -17,20 +13,19 @@ PermitRootLogin = "yes"; }; }; + networking.firewall.allowedTCPPorts = [ 8693 ]; services.fail2ban = { enable = true; bantime = lib.mkDefault "1h"; - jails = { - sshd = { - enabled = true; - settings = { - port = 8693; - backend = "systemd"; - maxretry = 4; - findtime = "10m"; - }; + jails.sshd = { + enabled = true; + settings = { + port = 8693; + backend = "systemd"; + maxretry = 4; + findtime = "10m"; }; }; }; @@ -38,55 +33,63 @@ security.pam.services.sshd.text = lib.mkDefault ( lib.mkAfter '' session optional pam_exec.so ${pkgs.writeShellScript "ssh-login-notify" '' - if [ "$PAM_TYPE" = "open_session" ]; then - TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") - HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) - - ( - ${pkgs.coreutils}/bin/echo "To: leander@schererleander.de" - ${pkgs.coreutils}/bin/echo "From: root@sachiel.schererleander.de" - ${pkgs.coreutils}/bin/echo "Subject: SSH Login Alert: $PAM_USER" - ${pkgs.coreutils}/bin/echo "Content-Type: text/html; charset=UTF-8" - ${pkgs.coreutils}/bin/echo "" - ${pkgs.coreutils}/bin/cat < - - - - - - -

SSH Login Alert

- -

A successful SSH login was just detected.

+ if [ "$PAM_TYPE" = "open_session" ]; then + TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") + HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) + + { + ${pkgs.coreutils}/bin/printf '%s\n' \ + "To: leander@schererleander.de" \ + "From: root@sachiel.schererleander.de" \ + "Subject: SSH login: $PAM_USER from $PAM_RHOST" \ + "Content-Type: text/html; charset=UTF-8" \ + "" + + ${pkgs.coreutils}/bin/cat < + + + + + + + +
+

SSH Login

+ + + + + + + + +
User$PAM_USER
Host$HOSTNAME
Time$TIMESTAMP
IP + $PAM_RHOST +
+
+ + +EOF + } | /run/wrappers/bin/sendmail \ + -f root@sachiel.schererleander.de \ + leander@schererleander.de + fi ''} '' ); -- cgit v1.3.1