uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead
https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
This commit is contained in:
Anton Arapov
Alan Daniels
commit
56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
357
nixos/modules/programs/ssh.nix
Normal file
357
nixos/modules/programs/ssh.nix
Normal file
|
|
@ -0,0 +1,357 @@
|
|||
# Global configuration for the SSH client.
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.programs.ssh;
|
||||
|
||||
askPassword = cfg.askPassword;
|
||||
|
||||
askPasswordWrapper = pkgs.writeScript "ssh-askpass-wrapper"
|
||||
''
|
||||
#! ${pkgs.runtimeShell} -e
|
||||
export DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^DISPLAY=\(.*\)/\1/; t; d')"
|
||||
exec ${askPassword} "$@"
|
||||
'';
|
||||
|
||||
knownHosts = attrValues cfg.knownHosts;
|
||||
|
||||
knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
|
||||
(h: assert h.hostNames != [];
|
||||
optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
|
||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
||||
)) + "\n";
|
||||
|
||||
knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
|
||||
++ map pkgs.copyPathToStore cfg.knownHostsFiles;
|
||||
|
||||
in
|
||||
{
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
programs.ssh = {
|
||||
|
||||
enableAskPassword = mkOption {
|
||||
type = types.bool;
|
||||
default = config.services.xserver.enable;
|
||||
defaultText = literalExpression "config.services.xserver.enable";
|
||||
description = "Whether to configure SSH_ASKPASS in the environment.";
|
||||
};
|
||||
|
||||
askPassword = mkOption {
|
||||
type = types.str;
|
||||
default = "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
|
||||
defaultText = literalExpression ''"''${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass"'';
|
||||
description = "Program used by SSH to ask for passwords.";
|
||||
};
|
||||
|
||||
forwardX11 = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to request X11 forwarding on outgoing connections by default.
|
||||
This is useful for running graphical programs on the remote machine and have them display to your local X11 server.
|
||||
Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two.
|
||||
Note: there are some security risks to forwarding an X11 connection.
|
||||
NixOS's X server is built with the SECURITY extension, which prevents some obvious attacks.
|
||||
To enable or disable forwarding on a per-connection basis, see the -X and -x options to ssh.
|
||||
The -Y option to ssh enables trusted forwarding, which bypasses the SECURITY extension.
|
||||
'';
|
||||
};
|
||||
|
||||
setXAuthLocation = mkOption {
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to set the path to <command>xauth</command> for X11-forwarded connections.
|
||||
This causes a dependency on X11 packages.
|
||||
'';
|
||||
};
|
||||
|
||||
pubkeyAcceptedKeyTypes = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
example = [ "ssh-ed25519" "ssh-rsa" ];
|
||||
description = ''
|
||||
Specifies the key types that will be used for public key authentication.
|
||||
'';
|
||||
};
|
||||
|
||||
hostKeyAlgorithms = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
example = [ "ssh-ed25519" "ssh-rsa" ];
|
||||
description = ''
|
||||
Specifies the host key algorithms that the client wants to use in order of preference.
|
||||
'';
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
description = ''
|
||||
Extra configuration text prepended to <filename>ssh_config</filename>. Other generated
|
||||
options will be added after a <code>Host *</code> pattern.
|
||||
See <citerefentry><refentrytitle>ssh_config</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
for help.
|
||||
'';
|
||||
};
|
||||
|
||||
startAgent = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to start the OpenSSH agent when you log in. The OpenSSH agent
|
||||
remembers private keys for you so that you don't have to type in
|
||||
passphrases every time you make an SSH connection. Use
|
||||
<command>ssh-add</command> to add a key to the agent.
|
||||
'';
|
||||
};
|
||||
|
||||
agentTimeout = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = "1h";
|
||||
description = ''
|
||||
How long to keep the private keys in memory. Use null to keep them forever.
|
||||
'';
|
||||
};
|
||||
|
||||
agentPKCS11Whitelist = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = literalExpression ''"''${pkgs.opensc}/lib/opensc-pkcs11.so"'';
|
||||
description = ''
|
||||
A pattern-list of acceptable paths for PKCS#11 shared libraries
|
||||
that may be used with the -s option to ssh-add.
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.openssh;
|
||||
defaultText = literalExpression "pkgs.openssh";
|
||||
description = ''
|
||||
The package used for the openssh client and daemon.
|
||||
'';
|
||||
};
|
||||
|
||||
knownHosts = mkOption {
|
||||
default = {};
|
||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
||||
options = {
|
||||
certAuthority = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
This public key is an SSH certificate authority, rather than an
|
||||
individual host's key.
|
||||
'';
|
||||
};
|
||||
hostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ name ] ++ config.extraHostNames;
|
||||
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
||||
description = ''
|
||||
A list of host names and/or IP numbers used for accessing
|
||||
the host's ssh service. This list includes the name of the
|
||||
containing <literal>knownHosts</literal> attribute by default
|
||||
for convenience. If you wish to configure multiple host keys
|
||||
for the same host use multiple <literal>knownHosts</literal>
|
||||
entries with different attribute names and the same
|
||||
<literal>hostNames</literal> list.
|
||||
'';
|
||||
};
|
||||
extraHostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = ''
|
||||
A list of additional host names and/or IP numbers used for
|
||||
accessing the host's ssh service. This list is ignored if
|
||||
<literal>hostNames</literal> is set explicitly.
|
||||
'';
|
||||
};
|
||||
publicKey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.str;
|
||||
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
||||
description = ''
|
||||
The public key data for the host. You can fetch a public key
|
||||
from a running SSH server with the <command>ssh-keyscan</command>
|
||||
command. The public key should not include any host names, only
|
||||
the key type and the key itself.
|
||||
'';
|
||||
};
|
||||
publicKeyFile = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.path;
|
||||
description = ''
|
||||
The path to the public key file for the host. The public
|
||||
key file is read at build time and saved in the Nix store.
|
||||
You can fetch a public key file from a running SSH server
|
||||
with the <command>ssh-keyscan</command> command. The content
|
||||
of the file should follow the same format as described for
|
||||
the <literal>publicKey</literal> option. Only a single key
|
||||
is supported. If a host has multiple keys, use
|
||||
<option>programs.ssh.knownHostsFiles</option> instead.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = ''
|
||||
The set of system-wide known SSH hosts. To make simple setups more
|
||||
convenient the name of an attribute in this set is used as a host name
|
||||
for the entry. This behaviour can be disabled by setting
|
||||
<literal>hostNames</literal> explicitly. You can use
|
||||
<literal>extraHostNames</literal> to add additional host names without
|
||||
disabling this default.
|
||||
'';
|
||||
example = literalExpression ''
|
||||
{
|
||||
myhost = {
|
||||
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
||||
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
||||
};
|
||||
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
||||
"myhost2.net/dsa" = {
|
||||
hostNames = [ "myhost2.net" ];
|
||||
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
knownHostsFiles = mkOption {
|
||||
default = [];
|
||||
type = with types; listOf path;
|
||||
description = ''
|
||||
Files containing SSH host keys to set as global known hosts.
|
||||
<literal>/etc/ssh/ssh_known_hosts</literal> (which is
|
||||
generated by <option>programs.ssh.knownHosts</option>) and
|
||||
<literal>/etc/ssh/ssh_known_hosts2</literal> are always
|
||||
included.
|
||||
'';
|
||||
example = literalExpression ''
|
||||
[
|
||||
./known_hosts
|
||||
(writeText "github.keys" '''
|
||||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
|
||||
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
''')
|
||||
]
|
||||
'';
|
||||
};
|
||||
|
||||
kexAlgorithms = mkOption {
|
||||
type = types.nullOr (types.listOf types.str);
|
||||
default = null;
|
||||
example = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
|
||||
description = ''
|
||||
Specifies the available KEX (Key Exchange) algorithms.
|
||||
'';
|
||||
};
|
||||
|
||||
ciphers = mkOption {
|
||||
type = types.nullOr (types.listOf types.str);
|
||||
default = null;
|
||||
example = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" ];
|
||||
description = ''
|
||||
Specifies the ciphers allowed and their order of preference.
|
||||
'';
|
||||
};
|
||||
|
||||
macs = mkOption {
|
||||
type = types.nullOr (types.listOf types.str);
|
||||
default = null;
|
||||
example = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha1" ];
|
||||
description = ''
|
||||
Specifies the MAC (message authentication code) algorithms in order of preference. The MAC algorithm is used
|
||||
for data integrity protection.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
programs.ssh.setXAuthLocation =
|
||||
mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 || config.services.openssh.forwardX11);
|
||||
|
||||
assertions =
|
||||
[ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
|
||||
message = "cannot enable X11 forwarding without setting XAuth location";
|
||||
}
|
||||
] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
|
||||
assertion = (data.publicKey == null && data.publicKeyFile != null) ||
|
||||
(data.publicKey != null && data.publicKeyFile == null);
|
||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
||||
});
|
||||
|
||||
# SSH configuration. Slight duplication of the sshd_config
|
||||
# generation in the sshd service.
|
||||
environment.etc."ssh/ssh_config".text =
|
||||
''
|
||||
# Custom options from `extraConfig`, to override generated options
|
||||
${cfg.extraConfig}
|
||||
|
||||
# Generated options from other settings
|
||||
Host *
|
||||
AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
|
||||
GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}
|
||||
|
||||
${optionalString cfg.setXAuthLocation ''
|
||||
XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
|
||||
''}
|
||||
|
||||
ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}
|
||||
|
||||
${optionalString (cfg.pubkeyAcceptedKeyTypes != []) "PubkeyAcceptedKeyTypes ${concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}
|
||||
${optionalString (cfg.hostKeyAlgorithms != []) "HostKeyAlgorithms ${concatStringsSep "," cfg.hostKeyAlgorithms}"}
|
||||
${optionalString (cfg.kexAlgorithms != null) "KexAlgorithms ${concatStringsSep "," cfg.kexAlgorithms}"}
|
||||
${optionalString (cfg.ciphers != null) "Ciphers ${concatStringsSep "," cfg.ciphers}"}
|
||||
${optionalString (cfg.macs != null) "MACs ${concatStringsSep "," cfg.macs}"}
|
||||
'';
|
||||
|
||||
environment.etc."ssh/ssh_known_hosts".text = knownHostsText;
|
||||
|
||||
# FIXME: this should really be socket-activated for über-awesomeness.
|
||||
systemd.user.services.ssh-agent = mkIf cfg.startAgent
|
||||
{ description = "SSH Agent";
|
||||
wantedBy = [ "default.target" ];
|
||||
unitConfig.ConditionUser = "!@system";
|
||||
serviceConfig =
|
||||
{ ExecStartPre = "${pkgs.coreutils}/bin/rm -f %t/ssh-agent";
|
||||
ExecStart =
|
||||
"${cfg.package}/bin/ssh-agent " +
|
||||
optionalString (cfg.agentTimeout != null) ("-t ${cfg.agentTimeout} ") +
|
||||
optionalString (cfg.agentPKCS11Whitelist != null) ("-P ${cfg.agentPKCS11Whitelist} ") +
|
||||
"-a %t/ssh-agent";
|
||||
StandardOutput = "null";
|
||||
Type = "forking";
|
||||
Restart = "on-failure";
|
||||
SuccessExitStatus = "0 2";
|
||||
};
|
||||
# Allow ssh-agent to ask for confirmation. This requires the
|
||||
# unit to know about the user's $DISPLAY (via ‘systemctl
|
||||
# import-environment’).
|
||||
environment.SSH_ASKPASS = optionalString cfg.enableAskPassword askPasswordWrapper;
|
||||
environment.DISPLAY = "fake"; # required to make ssh-agent start $SSH_ASKPASS
|
||||
};
|
||||
|
||||
environment.extraInit = optionalString cfg.startAgent
|
||||
''
|
||||
if [ -z "$SSH_AUTH_SOCK" -a -n "$XDG_RUNTIME_DIR" ]; then
|
||||
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"
|
||||
fi
|
||||
'';
|
||||
|
||||
environment.variables.SSH_ASKPASS = optionalString cfg.enableAskPassword askPassword;
|
||||
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue