Is there a nice benefit to using the structured form here, compared to the extraConfig?

It seems to me that it looks better. Also, the user can see the description here https://nixos.org/nixos/options.html#programs.ssh. and apply it in your config

@oxij variant with kexAlgorithms set to null not worked, error -
error: The option value programs.ssh.kexAlgorithms' in /home/test/src_nix/nixpkgs/nixos/modules/programs/ssh.nix' is not of type list of strings'.`
I do not plan to add all the options )

But what is your criteria for adding something

Honest question: what are ever the criteria? Is there a guideline? It seems like every module in the whole OS is subject to an arbitrary decision on how much of the configuration space to support "properly". Most modules of significant complexity seem not to support it all.

I've always seen deferring of module options to an extraConfig to be a necessary (due to manpower), but ultimately undesirable, practice, and thought that the more of the configuration space is supported, the better. Especially for something like sshd, where these things are quite stable; once the module code is in place, it should keep working and hopefully not need much maintenance.

What are the downsides? Worry about maintenance? Or does it bog down Hydra or something too?

If you write a script which translates sshd options into NixOS options, I think that would be something more people would welcome (at least, I would), but just adding code duplication (the ssh people already wrote that code) doesn't solve anything.

It's not as if NixOS would continue to support module options if the underlying tool would have removed it. As such for options for which NixOS cannot guarantee its continued support, manually created options don't make sense.

@Izorkin considering a few of these options have been implemented now and it seems unlikely the others will can we close this PR?

@aanderse, which options have been implemented? I've checked the code, and I don't see any changes to implement the options.

@Izorkin kexAlgorithms and ciphers appear on https://nixos.org/nixos/options.html#services.openssh.

This optins in openssh server. Such options are available for the openssh client.
https://man.openbsd.org/sshd_config#KexAlgorithms
https://man.openbsd.org/ssh_config#KexAlgorithms

@Izorkin ah sorry I only skimmed over this PR and didn't notice it was for the client software. Do you have any interest to rework this to include only the crypto options as @oxij mentioned?

@aanderse this variant normall?
Or preferredAuthentications remove?

I'm not sure if @oxij just meant kexAlgorithms and ciphers but that's what I assume.

preferredAuthentications removed.

This pull request has been mentioned on Nix community. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review-may-2019/3032/15

Example ssh config after this PR:

  programs.ssh = {
    ...
    macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
    ciphers = [ "chacha20-poly1305@openssh.com" ];
    kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
    ...
  };
  
  services.openssh = {
    ...
    macs = [ "hmac-sha2-512-etm@openssh.com" ];
    ciphers = [ "chacha20-poly1305@openssh.com" ];
    kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
    ...
  };

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-in-distress/3604/24