{ config, pkgs, ... }: { services.openssh = { enable = true; permitRootLogin = "no"; passwordAuthentication = false; kbdInteractiveAuthentication = false; kexAlgorithms = [ "sntrup761x25519-sha512@openssh.com" "curve25519-sha256" "curve25519-sha256@libssh.org" ]; macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "umac-128-etm@openssh.com" ]; }; # users.users.artemis.openssh.authorizedKeys.keys set in private }