{ flake.modules.nixos.openssh = { lib, pkgs, ... }: { services.openssh = { enable = true; ports = [ 8693 ]; settings = { AllowTcpForwarding = false; AllowAgentForwarding = false; PasswordAuthentication = false; X11Forwarding = false; PermitRootLogin = "yes"; }; }; networking.firewall.allowedTCPPorts = [ 8693 ]; services.fail2ban = { enable = true; bantime = lib.mkDefault "1h"; jails = { sshd = { enabled = true; settings = { port = 8693; backend = "systemd"; maxretry = 4; findtime = "10m"; }; }; }; }; security.pam.services.sshd.text = lib.mkDefault ( lib.mkAfter '' session optional pam_exec.so ${pkgs.writeShellScript "ssh-login-notify" '' if [ "$PAM_TYPE" = "open_session" ]; then TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) ( ${pkgs.coreutils}/bin/echo "To: leander@schererleander.de" ${pkgs.coreutils}/bin/echo "From: root@sachiel.schererleander.de" ${pkgs.coreutils}/bin/echo "Subject: SSH Login Alert: $PAM_USER" ${pkgs.coreutils}/bin/echo "Content-Type: text/html; charset=UTF-8" ${pkgs.coreutils}/bin/echo "" ${pkgs.coreutils}/bin/cat <

SSH Login Alert

A successful SSH login was just detected.

User$PAM_USER
Host$HOSTNAME
Time$TIMESTAMP
IP Address$PAM_RHOST
Service$PAM_SERVICE
TTY$PAM_TTY
EOF ) | /run/wrappers/bin/sendmail -f root@sachiel.schererleander.de leander@schererleander.de fi ''} '' ); }; }