From 15a15be2f67391b7cacc526173f7546ae4f30304 Mon Sep 17 00:00:00 2001 From: Evgeny Egorochkin Date: Wed, 5 Dec 2012 23:52:24 +0200 Subject: [PATCH 1/8] dhcpcd: disable "require dhcp_server_identifier" because of so many non-compliant DHCP servers --- modules/services/networking/dhcpcd.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/services/networking/dhcpcd.nix b/modules/services/networking/dhcpcd.nix index 122faf981366..a6c4ca5433d9 100644 --- a/modules/services/networking/dhcpcd.nix +++ b/modules/services/networking/dhcpcd.nix @@ -24,7 +24,8 @@ let option classless_static_routes, ntp_servers, interface_mtu # A ServerID is required by RFC2131. - require dhcp_server_identifier + # Commented out because of many non-compliant DHCP servers in the wild :( + #require dhcp_server_identifier # A hook script is provided to lookup the hostname if not set by # the DHCP server, but it should not be run by default. From 860cbf7890a303b35b97e6c5c2c77d8d7bd609d9 Mon Sep 17 00:00:00 2001 From: Evgeny Egorochkin Date: Thu, 6 Dec 2012 02:57:19 +0200 Subject: [PATCH 2/8] scanner support: create scanner group. Users need to be in this group to access scanners. --- modules/misc/ids.nix | 1 + modules/services/hardware/sane.nix | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/modules/misc/ids.nix b/modules/misc/ids.nix index 92e9bb908939..218bd0ed47a7 100644 --- a/modules/misc/ids.nix +++ b/modules/misc/ids.nix @@ -131,6 +131,7 @@ in spamd = 56; networkmanager = 57; nslcd = 58; + scanner = 59; # When adding a gid, make sure it doesn't match an existing uid. diff --git a/modules/services/hardware/sane.nix b/modules/services/hardware/sane.nix index 6849b3a7bc8e..905445f22c1b 100644 --- a/modules/services/hardware/sane.nix +++ b/modules/services/hardware/sane.nix @@ -29,6 +29,12 @@ with pkgs.lib; in mkIf config.hardware.sane.enable { environment.systemPackages = [ pkg ]; services.udev.packages = [ pkg ]; + + users.extraGroups = singleton { + name = "scanner"; + gid = config.ids.gids.scanner; + }; + }; } From 2b4715d3efad02ceb0d1959822cf928c50dfefd2 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 16 Nov 2012 16:34:22 +0100 Subject: [PATCH 3/8] Installer test: fix nix-push call http://hydra.nixos.org/build/3331147 --- tests/installer.nix | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/tests/installer.nix b/tests/installer.nix index 65542ae862eb..e5b47c730059 100644 --- a/tests/installer.nix +++ b/tests/installer.nix @@ -111,11 +111,9 @@ let # to simulate the Nixpkgs channel. $webserver->start; $webserver->waitForJob("httpd"); - $webserver->mustSucceed("mkdir /tmp/channel"); - $webserver->mustSucceed( - "nix-push file:///tmp/channel " . - "http://nixos.org/releases/nixos/channels/nixos-unstable " . - "file:///tmp/channel/MANIFEST ${toString channelContents} >&2"); + $webserver->succeed( + "nix-push --bzip2 --dest /tmp/channel --manifest --url-prefix http://nixos.org/channels/nixos-unstable " . + "${toString channelContents} >&2"); ''} # Make sure that we get a login prompt etc. From ef3199f782e536c598c99d6211359b9750c56054 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Thu, 22 Nov 2012 11:49:47 +0100 Subject: [PATCH 4/8] Add options for specifying binary caches Cherry-picked a4bcb26b1a3894022b08381079c2c402d49d611f. --- modules/services/misc/nix-daemon.nix | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/modules/services/misc/nix-daemon.nix b/modules/services/misc/nix-daemon.nix index a955fdd8d351..92e3b627f858 100644 --- a/modules/services/misc/nix-daemon.nix +++ b/modules/services/misc/nix-daemon.nix @@ -185,7 +185,30 @@ in you should increase this value. ''; }; + + binaryCaches = mkOption { + default = [ http://nixos.org/binary-cache ]; + type = types.list types.string; + description = '' + List of binary cache URLs used to obtain pre-built binaries + of Nix packages. + ''; + }; + + trustedBinaryCaches = mkOption { + default = [ ]; + example = [ http://hydra.nixos.org/ ]; + type = types.list types.string; + description = '' + List of binary cache URLs that non-root users can use (in + addition to those specified using + by passing + --option binary-caches to Nix commands. + ''; + }; + }; + }; @@ -216,6 +239,8 @@ in build-max-jobs = ${toString (config.nix.maxJobs)} build-use-chroot = ${if config.nix.useChroot then "true" else "false"} build-chroot-dirs = ${toString config.nix.chrootDirs} $(echo $extraPaths) + binary-caches = ${toString config.nix.binaryCaches} + trusted-binary-caches = ${toString config.nix.trustedBinaryCaches} $extraOptions END ''; From 13617b803b274af23dff428012f937b1677e64f6 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Sat, 8 Dec 2012 19:00:06 +0100 Subject: [PATCH 5/8] Use the binary cache in the installer Also remove "nixos-rebuild pull". --- default.nix | 1 - doc/manual/man-nixos-rebuild.xml | 13 --------- .../installer/cd-dvd/installation-cd-base.nix | 2 -- modules/installer/tools/nixos-install.sh | 9 +------ modules/installer/tools/nixos-rebuild.sh | 27 +------------------ modules/installer/tools/tools.nix | 24 +---------------- tests/installer.nix | 3 +-- 7 files changed, 4 insertions(+), 75 deletions(-) diff --git a/default.nix b/default.nix index fda19c3a149f..9d1475b69618 100644 --- a/default.nix +++ b/default.nix @@ -40,7 +40,6 @@ in # The following are used by nixos-rebuild. nixFallback = pkgs.nixUnstable; - manifests = config.installer.manifests; tests = config.tests; } diff --git a/doc/manual/man-nixos-rebuild.xml b/doc/manual/man-nixos-rebuild.xml index ddf4e40be0c2..4828215977e8 100644 --- a/doc/manual/man-nixos-rebuild.xml +++ b/doc/manual/man-nixos-rebuild.xml @@ -25,12 +25,10 @@ - - @@ -170,17 +168,6 @@ $ ./result/bin/run-*-vm partition, which is mounted read-only in the VM. - - - - - This operation fetches the latest manifest in the Nixpkgs - channel to speed up subsequent nix-env - operations. This is useful if you are not using - nix-channel but still want to use pre-built - binary packages. It doesn’t reconfigure the system - - diff --git a/modules/installer/cd-dvd/installation-cd-base.nix b/modules/installer/cd-dvd/installation-cd-base.nix index 375941d24479..1edb2a452360 100644 --- a/modules/installer/cd-dvd/installation-cd-base.nix +++ b/modules/installer/cd-dvd/installation-cd-base.nix @@ -42,8 +42,6 @@ in isoImage.volumeID = "NIXOS_${config.system.nixosVersion}"; - installer.nixosURL = "http://nixos.org/releases/nixos/nixos-${config.system.nixosVersion}"; - boot.postBootCommands = '' # Provide the NixOS/Nixpkgs sources in /etc/nixos. This is required diff --git a/modules/installer/tools/nixos-install.sh b/modules/installer/tools/nixos-install.sh index 4e89770cce56..a968369198e8 100644 --- a/modules/installer/tools/nixos-install.sh +++ b/modules/installer/tools/nixos-install.sh @@ -5,7 +5,6 @@ # - copy closure of Nix to target device # - register validity # - with a chroot to the target device: -# * do a nix-pull # * nix-env -p /nix/var/nix/profiles/system -i # * run the activation script of the configuration (also installs Grub) @@ -36,13 +35,6 @@ if ! test -e "$NIXOS_CONFIG"; then fi -# Do a nix-pull to speed up building. -if test -n "@nixosURL@" -a ${NIXOS_PULL:-1} != 0; then - mkdir -p /nix/var/nix/channel-cache -m 0755 - NIX_DOWNLOAD_CACHE=/nix/var/nix/channel-cache \ - @nix@/bin/nix-pull @nixosURL@/MANIFEST || true -fi - # Mount some stuff in the target root directory. We bind-mount /etc # into the chroot because we need networking and the nixbld user @@ -107,6 +99,7 @@ export LC_TIME= # Create a temporary Nix config file that causes the nixbld users to # be used. echo "build-users-group = nixbld" > $mountPoint/tmp/nix.conf +grep binary-caches /etc/nix/nix.conf >> $mountPoint/tmp/nix.conf export NIX_CONF_DIR=/tmp diff --git a/modules/installer/tools/nixos-rebuild.sh b/modules/installer/tools/nixos-rebuild.sh index e21a34f996c1..dba4b731f7c4 100644 --- a/modules/installer/tools/nixos-rebuild.sh +++ b/modules/installer/tools/nixos-rebuild.sh @@ -18,14 +18,11 @@ The operation is one of the following: build-vm-with-bootloader: like build-vm, but include a boot loader in the VM dry-run: just show what store paths would be built/downloaded - pull: just pull the NixOS channel manifest and exit Options: --upgrade fetch the latest version of NixOS before rebuilding --install-grub (re-)install the Grub bootloader - --pull do a nix-pull to get the latest NixOS channel - manifest --no-build-nix don't build the latest Nix from Nixpkgs before building NixOS --rollback restore the previous NixOS configuration (only @@ -49,7 +46,6 @@ EOF # Parse the command line. extraBuildFlags= action= -pullManifest= buildNix=1 rollback= upgrade= @@ -60,15 +56,12 @@ while test "$#" -gt 0; do --help) showSyntax ;; - switch|boot|test|build|dry-run|build-vm|build-vm-with-bootloader|pull) + switch|boot|test|build|dry-run|build-vm|build-vm-with-bootloader) action="$i" ;; --install-grub) export NIXOS_INSTALL_GRUB=1 ;; - --pull) - pullManifest=1 - ;; --no-build-nix) buildNix= ;; @@ -127,24 +120,6 @@ if initctl status nix-daemon 2>&1 | grep -q 'running'; then fi -# Pull the manifests defined in the configuration (the "manifests" -# attribute). Wonderfully hacky. -if [ -n "$pullManifest" -o "$action" = pull ]; then - set -o pipefail - manifests=$(nix-instantiate --eval-only --xml --strict '' -A manifests \ - | grep 'nixos-rebuild to speed up builds. - ''; - }; - installer.enableGraphicalTools = pkgs.lib.mkOption { default = false; type = with pkgs.lib.types; bool; diff --git a/tests/installer.nix b/tests/installer.nix index e5b47c730059..d57cbb6119ee 100644 --- a/tests/installer.nix +++ b/tests/installer.nix @@ -79,7 +79,7 @@ let { services.httpd.enable = true; services.httpd.adminAddr = "foo@example.org"; services.httpd.servedDirs = singleton - { urlPath = "/releases/nixos/channels/nixos-unstable"; + { urlPath = "/binary-cache"; dir = "/tmp/channel"; }; @@ -129,7 +129,6 @@ let "rm /etc/hosts", "echo 192.168.1.1 nixos.org > /etc/hosts", "ifconfig eth1 up 192.168.1.2", - "nixos-rebuild pull", ); # Test nix-env. From 68872f81cf71b85e5e25cb38b47d46f849b47964 Mon Sep 17 00:00:00 2001 From: Rickard Nilsson Date: Tue, 20 Nov 2012 15:13:17 +0100 Subject: [PATCH 6/8] openssh: Change the way authorized keys are added to the system. Instead of the somewhat hacky script that inserted public keys into the users' .ssh/authorized_keys files, use the AuthorizedKeysFile configuration directive in sshd_config and generate extra key files for each user (placed in /etc/authorized_keys.d/). --- modules/services/networking/ssh/sshd.nix | 110 ++++++----------------- 1 file changed, 26 insertions(+), 84 deletions(-) diff --git a/modules/services/networking/ssh/sshd.nix b/modules/services/networking/ssh/sshd.nix index 830559f3e9dc..01269e3f0d7e 100644 --- a/modules/services/networking/ssh/sshd.nix +++ b/modules/services/networking/ssh/sshd.nix @@ -40,102 +40,44 @@ let userOptions = { openssh.authorizedKeys = { - - preserveExistingKeys = mkOption { - type = types.bool; - default = true; - description = '' - If this option is enabled, the keys specified in - keys and/or keyFiles will be - placed in a special section of the user's authorized_keys file - and any existing keys will be preserved. That section will be - regenerated each time NixOS is activated. However, if - preserveExisting isn't enabled, the complete file - will be generated, and any user modifications will be wiped out. - ''; - }; - keys = mkOption { type = types.listOf types.string; default = []; description = '' - A list of verbatim OpenSSH public keys that should be inserted into the - user's authorized_keys file. You can combine the keys and + A list of verbatim OpenSSH public keys that should be added to the + user's authorized keys. The keys are added to a file that the SSH + daemon reads in addition to the the user's authorized_keys file. + You can combine the keys and keyFiles options. ''; }; keyFiles = mkOption { - #type = types.listOf types.string; default = []; description = '' - A list of files each containing one OpenSSH public keys that should be - inserted into the user's authorized_keys file. You can combine - the keyFiles and - keys options. + A list of files each containing one OpenSSH public key that should be + added to the user's authorized keys. The contents of the files are + read at build time and added to a file that the SSH daemon reads in + addition to the the user's authorized_keys file. You can combine the + keyFiles and keys options. ''; }; - }; }; - mkAuthkeyScript = - let - marker1 = "### NixOS auto-added key. Do not edit!"; - marker2 = "### NixOS will regenerate this file. Do not edit!"; - users = map (userName: getAttr userName config.users.extraUsers) (attrNames config.users.extraUsers); - usersWithKeys = flip filter users (u: - length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 - ); - userLoop = flip concatMapStrings usersWithKeys (u: - let - authKeys = concatStringsSep "," u.openssh.authorizedKeys.keys; - authKeyFiles = concatStrings (map (x: " ${x}") u.openssh.authorizedKeys.keyFiles); - preserveExisting = if u.openssh.authorizedKeys.preserveExistingKeys then "true" else "false"; - in '' - mkAuthKeysFile "${u.name}" "${authKeys}" "${authKeyFiles}" "${preserveExisting}" - '' - ); - in '' - mkAuthKeysFile() { - local userName="$1" - local authKeys="$2" - local authKeyFiles="$3" - local preserveExisting="$4" - - eval homeDir=~$userName - if ! [ -d "$homeDir" ]; then - echo "User $userName does not exist" - return - fi - if ! [ -d "$homeDir/.ssh" ]; then - mkdir -v -m 700 "$homeDir/.ssh" - chown "$userName":users "$homeDir/.ssh" - fi - local authKeysFile="$homeDir/.ssh/authorized_keys" - touch "$authKeysFile" - if [ "$preserveExisting" == false ]; then - rm -f "$authKeysFile" - echo "${marker2}" > "$authKeysFile" - else - sed -i '/${marker1}/ d' "$authKeysFile" - fi - IFS=, - for f in $authKeys; do - echo "$f ${marker1}" >> "$authKeysFile" - done - unset IFS - for f in $authKeyFiles; do - if [ -f "$f" ]; then - echo "$(cat "$f") ${marker1}" >> "$authKeysFile" - fi - done - chown "$userName" "$authKeysFile" - } - - ${userLoop} - ''; - + authKeysFiles = with { + mkAuthKeyFile = u: { + target = "ssh/authorized_keys.d/${u.name}"; + mode = "0444"; + source = pkgs.writeText "${u.name}-authorized_keys" '' + ${concatStringsSep "\n" u.openssh.authorizedKeys.keys} + ${concatMapStrings (f: builtins.readFile f + "\n") u.openssh.authorizedKeys.keyFiles} + ''; + }; + usersWithKeys = attrValues (flip filterAttrs config.users.extraUsers (n: u: + length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 + )); + }; map mkAuthKeyFile usersWithKeys; in @@ -305,7 +247,7 @@ in home = "/var/empty"; }; - environment.etc = [ + environment.etc = authKeysFiles ++ [ { source = "${pkgs.openssh}/etc/ssh/moduli"; target = "ssh/moduli"; } @@ -326,12 +268,10 @@ in LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive"; }; - path = [ pkgs.openssh pkgs.gnused ]; + path = [ pkgs.openssh ]; preStart = '' - ${mkAuthkeyScript} - mkdir -m 0755 -p /etc/ssh if ! test -f ${cfg.hostKeyPath}; then @@ -379,6 +319,8 @@ in GatewayPorts ${cfg.gatewayPorts} PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"} ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"} + + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u ''; assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true; From eda051cff5fda79181515c0cc65e07c5400d6ab9 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 11 Dec 2012 17:14:52 +0100 Subject: [PATCH 7/8] Remove abuse of "with" --- modules/services/networking/ssh/sshd.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/services/networking/ssh/sshd.nix b/modules/services/networking/ssh/sshd.nix index 01269e3f0d7e..2bfddb2e986f 100644 --- a/modules/services/networking/ssh/sshd.nix +++ b/modules/services/networking/ssh/sshd.nix @@ -65,7 +65,7 @@ let }; }; - authKeysFiles = with { + authKeysFiles = let mkAuthKeyFile = u: { target = "ssh/authorized_keys.d/${u.name}"; mode = "0444"; @@ -77,7 +77,7 @@ let usersWithKeys = attrValues (flip filterAttrs config.users.extraUsers (n: u: length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 )); - }; map mkAuthKeyFile usersWithKeys; + in map mkAuthKeyFile usersWithKeys; in @@ -198,11 +198,11 @@ in The set of system-wide known SSH hosts. ''; example = [ - { + { hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ]; publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub; } - { + { hostNames = [ "myhost2" ]; publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub; } From 78bd54ca804a3494257c57153520d49025804238 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 11 Dec 2012 17:29:34 +0100 Subject: [PATCH 8/8] Allow setting additional AuthorizedKeysFiles Charon needs this to include the dynamically generated /root/.vbox-charon-client-key. (We used users.extraUsers.root.openssh.authorizedKeys.keyFiles for this, but that no longer works.) --- modules/services/networking/ssh/sshd.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/services/networking/ssh/sshd.nix b/modules/services/networking/ssh/sshd.nix index 2bfddb2e986f..14570b76735f 100644 --- a/modules/services/networking/ssh/sshd.nix +++ b/modules/services/networking/ssh/sshd.nix @@ -186,6 +186,11 @@ in ''; }; + authorizedKeysFiles = mkOption { + default = []; + description = "Files from with authorized keys are read."; + }; + extraConfig = mkOption { default = ""; description = "Verbatim contents of sshd_config."; @@ -290,6 +295,9 @@ in networking.firewall.allowedTCPPorts = cfg.ports; + services.openssh.authorizedKeysFiles = + [ ".ssh/authorized_keys" ".ssh/authorized_keys2" "/etc/ssh/authorized_keys.d/%u" ]; + services.openssh.extraConfig = '' Protocol 2 @@ -320,7 +328,7 @@ in PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"} ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"} - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u + AuthorizedKeysFile ${toString cfg.authorizedKeysFiles} ''; assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;