diff --git a/configuration.nix b/configuration.nix
index cbb2054..7cd731b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -8,6 +8,7 @@
   imports =
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
+      ./sshusers.nix
       ./variables.nix
       ./mailserver.nix
     ];
@@ -71,7 +72,11 @@
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    # Only allow login through pubkey
+    passwordAuthentication = false;
+  };
 
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
@@ -79,22 +84,10 @@
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
 
-  users.extraUsers."Entil_Zha" = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAgEAzeqpZiYL+NFikGyVU7h+5nvAovlJBQfwQHE7mXkYVokHDCykHDUZfeR2HKARaGnCcYyvWHZeZPDJzQg05INRZyook82qKhqc/aICthP0dolr8ImYsilkbSPd1SttZWEsURVz8UO9NtM6n++04p6ArCRL4eZMzq8OeeGc+Vmyu4jRcsIA3t6kuXJ5FECmNn9YOmV8gX5WOzN0akPRwlE1XmBszU7r+OktYOmg4P7kJpmRoV8hR6zBtAcSjCuELJhE7aKGa2UnIoWzLMt5JV0JP4fPjbZxYpWmGxwLgIp/YXuJ/+xVwGTAjUXanqyV4RPpSNQa78CZ4g5rW7ak9xWN46ChWO9ishQDak2o6jdCli2Vjj32ap/snfDMiHylbbgpdmF2l8CTTo2GODfvKEZI1kzFz/Cfeky/uZzvvVjgbVUAwIFscFWyTpgnZibEA/H5xCkVxI+icFzQALgnBVY/75Jw8jrdUzcMDWNKjMaGhegXJAuIZXueDJTuxiZcAXXTWdPqQCTitQitE6Gf/gnijmtBBKT3uVk/ZBwhZH5GrBRNL+A3dlHAqGvl1SlajQtAzhaZmEp1yIeObhzXJKi41vHSOxfJzQDqQz0H2ljmAK6c/0bEyohxiQ3+/pIyvHG4hgSKWG8ng7Np2bD7xoWV7WgZBys3TsDZdeTu8xMyl7U="
-    ];
-  };
+  # User configuration for root.
+  # Other users are defined in sshusers.nix
   users.extraUsers.root = {
     hashedPassword = "!";
-    openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCr2msBYPpr9RJ4rHcEyn0W0NMgUnOVO66FdEwXf0O7gBm37urOdVEIr/AcV1z5dzaOolMacW+rs3OyWWKBSjvAG9CRQ/KslUz/ucwBlVdnjNRtvDnbXh/VLFl62mF/4AWmV8CTFas9Uckcb7oauSJhx9PjwrkNs4pyz0wyMwMeUZ9dcjr/kho60aixTfdX9b3suZ8MQSwDagPeyjbFmGHNL1R0hY1fJZsyzBgGfNv9uaRAfxjWRzGb4G1e8AXnK/gG5bnifcDwWz4QQHDRZhW4/f4h/JE8+tBkiyZnsiULyDsCmg1waMeuKD/eweK5JyFpnaInctHJNEMBAC8RHakm2jgE3lLrHzglzhSu64vJeotbiZdbBcXLGQ4QIoFC6pATJ0LxQ5u3hXVGR6cvHNuFobD8tJUa8LCkAUfuA5m0OTbXxv8AId7aS/CSv504tG7v6r1q+wNQvGCpuzq4ykOSbj4hgdXFFfAOM+g/qZLhormOirN4XyD0b8gY1JmCaQhiRSoB0sqgi6tVeioX6YJkuBOpKJ9Pu6TRHjFLnEV5rwLRWwxrlZVXTMuqXk3h9LR0HHl88gDpSWvF3SJkSL9CgJiZk4EauCvS7nQQKKnobbxBcr23hqAOdz2brCKABZC2cvuKXRFo9ekrjdV7jw2NSPEJ3syeyMpUpd3m62f8vtbExlY0wsSUvn9wh6QPnI0vio4qqjGucb9MIhc7R06F3diHFNTfoVNZEBBlaVPL3f5S4VuNv3Me9qjBZKpE8NtjZ2xLZDruVBrTIeVWb4XGbzBQKC/zmap1Yz2VIR0j9l8GiKcD193C9CftmDJloTnfddjbuJ08q2e/CYiR02/7uJUiUro30/uafUvJCipidzThoNxBpHaKWNWH75/37FzzxY/zpFdZfo3yKW7M4wyzSUnA7mNKLySq7PkHEvHzOGVP65CQoIi4/aPWqrOi8Da/58gKro3cob4DaZah1kEicb5olLgiLnLkr04G0YsTgY0/GFGN1aYqoR3jMJOGyDhuBXVis89SlOHJUySDwpQHXD+aNR0Hy/Vya+Z1YEMGui2wh+uE2Rma0lrfQ1DL608CkmG/NlZ4/uIBDb1ZK6uVnSVfnCam+MP4prhDtItNa8XegJsUen5wmwPNJg1yYdsPqS6Uz1MYtJ9lhIbnfq5SnrYWZjcBp7w9QMAfy/EyLJ/W2/CxD8bPxuteAoGt+KDa/CBL4SOliRzc2LM/VkiqXn3Nl1y/hee5CpLTWvM/i4TRAHt/T0B/EwHFzBbKYupvP7lVswCkr9c24VtAxsqKzXsZ29jvYCUP+H6SicHtXc3USBpjIhdMQu9yDkyiJf+q52xVPWnO5XOntdXFamqd dfrank@arya"
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPzSbarSmz6U5+M9a9qwWpmCbs3rOwy28LuOgjfTlHfdi5eTWLq8xj8N089A3oJ/XBnGFtenwDNnk8mZYS/dkCwnaWw3PDCTgGqHW2RUGp08AMr39BPlwjXbHv3PpCIHudnbK2vpSoa/6cG4mJNG8b2htJazTq+ZFDERPsOCsWEy29+B6VfhsVgdauVFQf8iGiEz6AbF7+8CstVnk0sFKF0uUeLReqEayqxEhLucRaFCDXYRZYFGdnX98ATYdyF2bT5XLET0Wq7xeZhOtBdvscn5CfuhUN4tVh1Esux7XGo+Swyf01leaQcAXwBL/k0yUF0ZLbpUihwUGfB4ACnE7njiCVcO0gav9FLhbHz3gAQyhlvQ4pRxQnzuH21jC7fSBo0KJjK75CunXMh88q4/v/J+hmOY3b4BIvL3wUyFIFJqkWlKjC8L4GK0O0tvqdVu8c4xBLkABKhLf2ij9sUwxxZs83dZb+tiq/0Ltkgu2nMQz0ae83KW249BNV9Etuz6c4PpfjRvyhyqR/ImVlf3hMQy5ApD0xZEQZbSVUUcAf+LxKxmS8ZTL5Tt96d7EoByMU7wgl6vJw4BUNjrSKzXpS9TC6qt8cfff1L948qgJ9dY8A1s2pM3ZWK4649OhGOtVCh9UbK7oe/kmAx/bX41go22YwLCvvA7SkVzPukHvQdQ== cardno:000607203673"
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHTKjXa1Z+isxj7bajBx7BLP+5z2KSlMVcQhXUHWdQJHdMPG18We2Lc3MXp2NE8uxzCHwqP3UKjYBmG4cp7h5mpUMCIaRc6SDg5rpipE9eSMFeoE8qgnjCf7gNl0xWP1YqPruYIDgK3e4AWr5Z8xEHECbWQYlcCo82jR9RoWP6fgNxSDPzKGwMv5cyXEw2+2DHhuDHUXA8cz9sY32gum/jE8GyJRTJEfZ7y3wSe4ufH+AdzbIM0dohMZK9RNdKCll6utdyBV2Pj359ShzBWrBHpi77R5yHOTtp5IKnL66HJ9Y6Ig0cy9rTiZwFkGkYiX73GCNgQHm/fJhc4Qs+g2IVyJNaORjKKE6IrxA5/KJLnDY49pJfOIZEOUKn1jWiwxib/7pPT2RFxVxfe1wpqmG+mI6YD/WK58TFEGvsgeWuTfFN7EWFX2BhElHYtlupooyw2FAGQPa73mdUpXji1/PnBrwjYVyzOy+tS73aUVrge8ymIPWRdxh99h4Rxfta3xFAGvX4qZZUtoK2114qZJ8rK3QzXTarKOpmN06b0m6nsdvzxWHKq5d1eI4P2Zm9P2IeaAklPCMgRb72L3bA19Dvp77PkucBc8er5XL/HSldvVPBUyBQ7CZ56lFpnnH0biKtJmC/kwKcFnVBjsgKL4+/yBoN+H9KqKfeDqDOBqVhsw== Alexander"
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFtVHDcpRTpKiNLRuhtIp/RQlJpfJoDlGpfWeBEj1mUo/7XhUWCVsRb/VidC3zoGt1fJ1yV0wKm+NhCq9qBlOyu1Xza9D77Eowij4Qv46vxnnh94XYG+KU5FoAQ+FWQftdF4YXLMPOi+idIC6KDkfJftky1WuiTvTHskjkZ+fPE/o26P2lIvHHv67xqFWJeoLgIEC7BQmDeGpSBN8gCGEhxFZ2vKHcOU8rfMPHwNbAQHW9PXhb9jNIkRck3CM8LwiUxm8Ya5BEwx5BJgoBSsPT6verLJ74uVNttDuPsz+mqey9nM01Wlt86d06WE5YjQb/AEpg+uKW9LZ63fwltgWn leo"
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbTKYDYRivHfk/nDYvrgV51DFMkmDwnet1iaFoNTEqx99rVPQMchlKtCEwzKiuzjPyc7ztrMpnCkUKIhBs2C5eVoWHtiCebFn5jMM6YA1+/gP0xJF+n9YjO6BIQC1MeppSjO/yP/rjcrEc1DVAY95ofDge94vRAeAUhADDOvEqUd3OOvRwc5WWN+PuCnnSqo1am9NMMyZftI9FpkpswKhkEQfIteadEVySWQtO4rs5GC6JcfE2ZIZEEjp9tMm7zr6FNnCJNuuTU4trWUJDKRiKnyNyKb9GZHQ+LA1VPN8Xyi0gVhdyE5I9z83xTeYRbmW49gtJ9iCQxzcBaylByTRZQYLZWoQIqOBtjVx08CwMM4g+U9JvEULqkRbxmfO9kCPGSm1ZrUN4Dfz087Lt3kebq+sGIgD/yJG5ZS5hbLjq3+ClQA9C6pgu8xsidgDNZV+f8h6pEBTFH5bdhOvJVa3XdemlKKD5VxZdjPlgqrBBobVkCvvwucCXUqpcHRTaygwlQzWMUFonxdJF3sil+x5d9UtJyPt6CH8QHOVeTKe67TgS3b6LA0WscUGhSFqwaOGaNEiHWqCWj/mM6AdepWHuspW4mbSv2cUk5wxIXqj0JVqE5bY9iiRODpOpx2a3+XhSLA8JVgvm7JRY1+tG9/PwtsoSvv3/y3IPcQHYIfmYXw== openpgp:0x36379070 leo"
-    ];
   };
 
   # This value determines the NixOS release with which your system is to be
diff --git a/sshusers.nix b/sshusers.nix
new file mode 100644
index 0000000..6c58bf4
--- /dev/null
+++ b/sshusers.nix
@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+
+let
+  sshkeys = pkgs.fetchFromGitHub {
+    owner = "freifunkhamburg";
+    "repo" = "ssh-keys";
+    rev = "70a8f1a4b8ddf921579986fb08b45050abeef2bc";
+    sha512 = "05p3ypg5imjxiswsspiix1l783w11ddby78bwjv0dnppbz8i4ddiy8fz70vcz4q2fbb94kwnk5zm7mz53h24z3j97xq9d485nmxinpq";
+  };
+  getpubkeys = user: builtins.readFile "${sshkeys}/${user}.pub";
+  mkuser = user: { name = user; isNormalUser = true; extraGroups = [ "wheel" ]; initialPassword = "test1234"; openssh.authorizedKeys.keys = [ (getpubkeys user) ]; };
+  mkusers = users: map (mkuser) users;
+in
+{
+  users.users = mkusers [ "tokudan" "Entil_Zha" "alexander" ];
+}