From 64a15676ac5b7cb8990d683f19ad78ac9a6bc4ef Mon Sep 17 00:00:00 2001 From: sbh69840 Date: Tue, 9 May 2023 15:57:49 +0530 Subject: support authorized_keys for users --- modules/programs/ssh/default.nix | 61 +++++++++++++++++++++++++++++++++++----- 1 file changed, 54 insertions(+), 7 deletions(-) (limited to 'modules/programs') diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index f93890f..2c0117c 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -47,10 +47,56 @@ let hostNames = mkDefault [ name ]; }; }; + userOptions = { + + options.openssh.authorizedKeys = { + keys = mkOption { + type = types.listOf types.str; + default = []; + description = '' + A list of verbatim OpenSSH public keys that should be added to the + user's authorized keys. The keys are added to a file that the SSH + daemon reads in addition to the the user's authorized_keys file. + You can combine the keys and + keyFiles options. + Warning: If you are using NixOps then don't use this + option since it will replace the key required for deployment via ssh. + ''; + }; + + keyFiles = mkOption { + type = types.listOf types.path; + default = []; + description = '' + A list of files each containing one OpenSSH public key that should be + added to the user's authorized keys. The contents of the files are + read at build time and added to a file that the SSH daemon reads in + addition to the the user's authorized_keys file. You can combine the + keyFiles and keys options. + ''; + }; + }; + + }; + authKeysFiles = let + mkAuthKeyFile = u: nameValuePair "ssh/authorized_keys.d/${u.name}" { + text = '' + ${concatStringsSep "\n" u.openssh.authorizedKeys.keys} + ${concatMapStrings (f: readFile f + "\n") u.openssh.authorizedKeys.keyFiles} + ''; + }; + usersWithKeys = attrValues (flip filterAttrs config.users.users (n: u: + length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 + )); + in listToAttrs (map mkAuthKeyFile usersWithKeys); in { options = { + + users.users = mkOption { + type = with types; attrsOf (submodule userOptions); + }; programs.ssh.knownHosts = mkOption { default = {}; @@ -80,12 +126,13 @@ in (data.publicKey != null && data.publicKeyFile == null); message = "knownHost ${name} must contain either a publicKey or publicKeyFile"; }); - - environment.etc."ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts - (h: assert h.hostNames != []; - concatStringsSep "," h.hostNames + " " - + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile) - )) + "\n"; - + + environment.etc = authKeysFiles // + { "ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts + (h: assert h.hostNames != []; + concatStringsSep "," h.hostNames + " " + + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile) + )) + "\n"; + }; }; } -- cgit v1.2.3 From ecb5840f6bc2cdb453bbc0dbbd8f63ec441808d6 Mon Sep 17 00:00:00 2001 From: sbh69840 Date: Wed, 10 May 2023 19:35:23 +0530 Subject: enable copy --- modules/programs/ssh/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'modules/programs') diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index 2c0117c..7797e4d 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -80,6 +80,7 @@ let }; authKeysFiles = let mkAuthKeyFile = u: nameValuePair "ssh/authorized_keys.d/${u.name}" { + copy = true; text = '' ${concatStringsSep "\n" u.openssh.authorizedKeys.keys} ${concatMapStrings (f: readFile f + "\n") u.openssh.authorizedKeys.keyFiles} -- cgit v1.2.3 From ab2e16159f5a04fd962f3d7de8dc4901d048db17 Mon Sep 17 00:00:00 2001 From: sbh69840 Date: Wed, 10 May 2023 21:16:52 +0530 Subject: authkeys path in sshd_config --- modules/programs/ssh/default.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'modules/programs') diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index 7797e4d..b8baec6 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -90,6 +90,13 @@ let length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 )); in listToAttrs (map mkAuthKeyFile usersWithKeys); + authKeysConfiguration = + { + "ssh/sshd_config.d/101-authorized-keys.conf" = { + copy = true; + text = "AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u"; + }; + }; in { @@ -128,7 +135,7 @@ in message = "knownHost ${name} must contain either a publicKey or publicKeyFile"; }); - environment.etc = authKeysFiles // + environment.etc = authKeysFiles // authKeysConfiguration // { "ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts (h: assert h.hostNames != []; concatStringsSep "," h.hostNames + " " -- cgit v1.2.3 From 4094dbccde0d00fd062d365b8c79526711a6bc95 Mon Sep 17 00:00:00 2001 From: sbh69840 Date: Wed, 10 May 2023 21:30:35 +0530 Subject: newline eof for authorized-keys conf --- modules/programs/ssh/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules/programs') diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index b8baec6..2d008df 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -94,7 +94,7 @@ let { "ssh/sshd_config.d/101-authorized-keys.conf" = { copy = true; - text = "AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u"; + text = "AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u\n"; }; }; in -- cgit v1.2.3 From f781cb0ac5ea2daa5183b8df8f4de4ef0747f440 Mon Sep 17 00:00:00 2001 From: sbh69840 Date: Wed, 10 May 2023 21:39:27 +0530 Subject: give credits --- modules/programs/ssh/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'modules/programs') diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index 2d008df..f1dde9a 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -47,6 +47,7 @@ let hostNames = mkDefault [ name ]; }; }; + # Taken from: https://github.com/NixOS/nixpkgs/blob/f4aa6afa5f934ece2d1eb3157e392d056be01617/nixos/modules/services/networking/ssh/sshd.nix#L46-L93 userOptions = { options.openssh.authorizedKeys = { -- cgit v1.2.3