nixos/sshd: implement support for Match groups
#56345
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GrahamcOfBorg
added
6.topic: nixos
|
@GrahamcOfBorg test openssh |
|
The test breaks on aarch64 because of a timeout btw. |
This patch makes it way harder to screw Match groups in an `sshd` config
up. With a broken SSH, reverting with tools like `nixops` is way harder,
in some cases impossible.
The diff seems larger than it actually is, mainly because I moved all
options that can be used "globally" and in a `Match` group into its own
attribute set that will be merged into `options.services.openssh` and
for the `matches` submodule.
The `Match` config will be appended to `/etc/ssh/sshd_config` using
`mkOrder 9999` to ensure that no `extraConfig` will be appended
afterwards and only applies to the last Match group.
It can be used like this now:
``` nix
{
services.openssh = {
enable = true;
permitRootLogin = "no";
matches = [
{
# the given config only applies to the 10.23.42.0/24 subnet
match."10.23.42.0/24" = "Address";
config.permitRootLogin = "yes";
}
];
};
}
```
Finally extended the `openssh` testcase with another machine to demonstrate
the functionality by permitting root logins only from certain IPs.
Ma27
force-pushed
the
implement-match-sections-for-sshd
branch
from
d3793d9
to
7b1261c
Compare
|
@GrahamcOfBorg test openssh |
Ma27
commented
Feb 25, 2019
| }; | ||
|
|
||
| config = mkOption { | ||
| type = types.submodule ({ options = generalOptions; }); |
There was a problem hiding this comment.
We probably want to merge the values here with the configs from services.openssh. So if somebody sets services.openssh.permitRootLogin to no, each Match group should also have permitRootLogin set to no.
But I'll wait for some reviews from other folks, before spending more time on this :)
|
Closing for now, mainly because of NixOS/rfcs#42 (also discussed in I'm in favor of that approach and this adds even more complexity to the module system and hence makes the situation even worse. The main goal (making it harder to screw up ssh configs) can be achieved using sshd's config validation. I'll look how we can do this for our sshd_config and file a patch soon :) |
10 tasks
Ma27
added a commit
to Ma27/nixpkgs
that referenced
this pull request
May 24, 2019
With `sshd -t` config validation for SSH is possible. Until now, the config generated by Nix was applied without any validation (which is especially a problem for advanced config like `Match` blocks). When deploying broken ssh config with nixops to a remote machine it gets even harder to fix the problem due to the broken ssh that makes reverts with nixops impossible. This change performs the validation in a Nix build environment by creating a store path with the config and generating a mocked host key which seems to be needed for the validation. With a broken config, the deployment already fails during the build of the derivation. The original attempt was done in NixOS#56345 by adding a submodule for Match groups to make it harder screwing that up, however that made the module far more complex and config should be described in an easier way as described in NixOS/rfcs#42.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
This patch makes it way harder to screw Match groups in an
sshdconfigup. With a broken SSH, reverting with tools like
nixopsis way harder,in some cases impossible.
The diff seems larger than it actually is, mainly because I moved all
options that can be used "globally" and in a
Matchgroup into its ownattribute set that will be merged into
options.services.opensshandfor the
matchessubmodule.The
Matchconfig will be appended to/etc/ssh/sshd_configusingmkOrder 9999to ensure that noextraConfigwill be appendedafterwards and only applies to the last Match group.
It can be used like this now:
Finally extended the
opensshtestcase with another machine to demonstratethe functionality by permitting root logins only from certain IPs.
Some additional notes:
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)