base: disable authorized keys in ~/.ssh/authorized_keys

mgit-at · May 8, 2024 · d46372d · d46372d
1 parent c7ea230
commit d46372d
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 6 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/modules/defaults/base/sshd.nix b/modules/defaults/base/sshd.nix
@@ -15,6 +15,9 @@ with lib;
       UsePAM = true;
     };
 
+    # disable ~/.ssh/authorized_keys (default in 24.11)
+    authorizedKeysInHomedir = false;
+
     # https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/doc/user/gitlab_com/index.md#ssh-host-keys-fingerprints
     knownHosts."gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
     # https://github.blog/2021-09-01-improving-git-protocol-security-github/#new-host-keys