{ flake.modules.nixos.openssh = { lib, pkgs, ... }: { services.openssh = { enable = true; ports = [ 8693 ]; settings = { AllowTcpForwarding = false; AllowAgentForwarding = false; PasswordAuthentication = false; X11Forwarding = false; PermitRootLogin = "yes"; }; }; networking.firewall.allowedTCPPorts = [ 8693 ]; services.fail2ban = { enable = true; bantime = lib.mkDefault "1h"; jails.sshd = { enabled = true; settings = { port = 8693; backend = "systemd"; maxretry = 4; findtime = "10m"; }; }; }; security.pam.services.sshd.text = lib.mkDefault ( lib.mkAfter '' session optional pam_exec.so ${pkgs.writeShellScript "ssh-login-notify" '' if [ "$PAM_TYPE" = "open_session" ]; then TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) { ${pkgs.coreutils}/bin/printf '%s\n' \ "To: leander@schererleander.de" \ "From: root@sachiel.schererleander.de" \ "Subject: SSH login: $PAM_USER from $PAM_RHOST" \ "Content-Type: text/html; charset=UTF-8" \ "" ${pkgs.coreutils}/bin/cat <

SSH Login

User	$PAM_USER
Host	$HOSTNAME
Time	$TIMESTAMP
IP	$PAM_RHOST

EOF } | /run/wrappers/bin/sendmail \ -f root@sachiel.schererleander.de \ leander@schererleander.de fi ''} '' ); }; }