I use ssh as a poor man’s sudo that relies on a cryptographic key instead of a password. To do that, I typically allow root login only through localhost, to reduce attack surface. You first login as a local user, and then use ssh root@localhost to escalate privileges. This required configuring the SSH daemon in a very specific way.

Recently, I discovered systemd-ssh-proxy, a small plugin for the SSH daemon that:

  1. Enables ssh [email protected]. Under the hood, this relies on UNIX or VSOCK sockets and doesn’t involve any networking.
  2. Is enabled by default on NixOS.

I have now simplified my SSH configuration. Using defaults where possible is better and less error-prone.