mirror of
https://github.com/LnL7/nix-darwin.git
synced 2024-08-17 08:30:23 +03:00
ssh: fix public keys in home directory not working
Added `services.openssh.authorizedKeysFiles` option from NixOS.
This commit is contained in:
parent
b8c286c82c
commit
257b5c1994
@ -1,4 +1,4 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, ... }:
|
||||||
|
|
||||||
with lib;
|
with lib;
|
||||||
|
|
||||||
@ -79,6 +79,7 @@ let
|
|||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
authKeysFiles = let
|
authKeysFiles = let
|
||||||
mkAuthKeyFile = u: nameValuePair "ssh/authorized_keys.d/${u.name}" {
|
mkAuthKeyFile = u: nameValuePair "ssh/authorized_keys.d/${u.name}" {
|
||||||
copy = true;
|
copy = true;
|
||||||
@ -91,22 +92,33 @@ let
|
|||||||
length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
|
length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
|
||||||
));
|
));
|
||||||
in listToAttrs (map mkAuthKeyFile usersWithKeys);
|
in listToAttrs (map mkAuthKeyFile usersWithKeys);
|
||||||
authKeysConfiguration =
|
|
||||||
{
|
oldAuthorizedKeysHash = "5a5dc1e20e8abc162ad1cc0259bfd1dbb77981013d87625f97d9bd215175fc0a";
|
||||||
"ssh/sshd_config.d/101-authorized-keys.conf" = {
|
|
||||||
copy = true;
|
|
||||||
text = "AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u\n";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in
|
in
|
||||||
|
|
||||||
{
|
{
|
||||||
options = {
|
options = {
|
||||||
|
|
||||||
users.users = mkOption {
|
users.users = mkOption {
|
||||||
type = with types; attrsOf (submodule userOptions);
|
type = with types; attrsOf (submodule userOptions);
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.openssh.authorizedKeysFiles = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Specify the rules for which files to read on the host.
|
||||||
|
|
||||||
|
This is an advanced option. If you're looking to configure user
|
||||||
|
keys, you can generally use [](#opt-users.users._name_.openssh.authorizedKeys.keys)
|
||||||
|
or [](#opt-users.users._name_.openssh.authorizedKeys.keyFiles).
|
||||||
|
|
||||||
|
These are paths relative to the host root file system or home
|
||||||
|
directories and they are subject to certain token expansion rules.
|
||||||
|
See AuthorizedKeysFile in man sshd_config for details.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
programs.ssh.knownHosts = mkOption {
|
programs.ssh.knownHosts = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule host);
|
type = types.attrsOf (types.submodule host);
|
||||||
@ -135,13 +147,30 @@ in
|
|||||||
(data.publicKey != null && data.publicKeyFile == null);
|
(data.publicKey != null && data.publicKeyFile == null);
|
||||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
||||||
});
|
});
|
||||||
|
|
||||||
environment.etc = authKeysFiles // authKeysConfiguration //
|
services.openssh.authorizedKeysFiles = [ "%h/.ssh/authorized_keys" "/etc/ssh/authorized_keys.d/%u" ];
|
||||||
|
|
||||||
|
environment.etc = authKeysFiles //
|
||||||
{ "ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts
|
{ "ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts
|
||||||
(h: assert h.hostNames != [];
|
(h: assert h.hostNames != [];
|
||||||
concatStringsSep "," h.hostNames + " "
|
concatStringsSep "," h.hostNames + " "
|
||||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
||||||
)) + "\n";
|
)) + "\n";
|
||||||
|
|
||||||
|
"ssh/sshd_config.d/101-authorized-keys.conf" = {
|
||||||
|
text = "AuthorizedKeysFile ${toString config.services.openssh.authorizedKeysFiles}\n";
|
||||||
|
# Allows us to automatically migrate from using a file to a symlink
|
||||||
|
knownSha256Hashes = [ oldAuthorizedKeysHash ];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Clean up .orig file left over from using knownSha256Hashes
|
||||||
|
system.activationScripts.etc.text = ''
|
||||||
|
auth_keys_orig=/etc/ssh/sshd_config.d/101-authorized-keys.conf.orig
|
||||||
|
|
||||||
|
if [ -e "$auth_keys_orig" ] && [ "$(shasum -a 256 $auth_keys_orig | cut -d ' ' -f 1)" = "${oldAuthorizedKeysHash}" ]; then
|
||||||
|
rm "$auth_keys_orig"
|
||||||
|
fi
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
@ -15,6 +15,6 @@
|
|||||||
echo >&2 "checking for authorized keys for foo in /etc/ssh/authorized_keys.d/foo"
|
echo >&2 "checking for authorized keys for foo in /etc/ssh/authorized_keys.d/foo"
|
||||||
grep 'ssh-ed25519 AAAA...' ${config.out}/etc/ssh/authorized_keys.d/foo
|
grep 'ssh-ed25519 AAAA...' ${config.out}/etc/ssh/authorized_keys.d/foo
|
||||||
echo >&2 "checking for authorized keys' path in /etc/ssh/sshd_config.d/101-authorized-keys.conf"
|
echo >&2 "checking for authorized keys' path in /etc/ssh/sshd_config.d/101-authorized-keys.conf"
|
||||||
grep 'AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u' ${config.out}/etc/ssh/sshd_config.d/101-authorized-keys.conf
|
grep 'AuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u' ${config.out}/etc/ssh/sshd_config.d/101-authorized-keys.conf
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user