diff --git a/modules/nixos/services/openssh/default.nix b/modules/nixos/services/openssh/default.nix
new file mode 100644
index 0000000..5452421
--- /dev/null
+++ b/modules/nixos/services/openssh/default.nix
@@ -0,0 +1,18 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.marleyos.services.openssh;
+in {
+  options.marleyos.services.openssh.enable = lib.mkEnableOption "openssh";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+      };
+    };
+  };
+}