From da72da34a17847f7928b1eb01937368d52f61b64 Mon Sep 17 00:00:00 2001
From: hektor <hektor.misplon@pm.me>
Date: Sun, 12 Jul 2026 13:43:17 +0200
Subject: [PATCH] fix(ssh): enforce SSH public key authentication only in depth

---
 modules/ssh/hardened-openssh.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/ssh/hardened-openssh.nix b/modules/ssh/hardened-openssh.nix
index 35df3a11..1e1e827b 100644
--- a/modules/ssh/hardened-openssh.nix
+++ b/modules/ssh/hardened-openssh.nix
@@ -20,6 +20,7 @@ in
     services.openssh.settings = optionalAttrs cfg.harden {
       PermitRootLogin = "no";
       PasswordAuthentication = false;
+      AuthenticationMethods = "publickey";
       KbdInteractiveAuthentication = false;
       ChallengeResponseAuthentication = false;
       X11Forwarding = false;