When the 'banner' option was removed in favour of settings.Banner,
it was made a path-typed option, but the current mkValueString doesn't
accept path-typed values so assigning a file to this option results in:
`error: unsupported type path: <store path>`
By adding the appropriate handling for mkValueString, this works as
expected.
Prior to this commit, NixOS enabled a set of curated algorithms.
This commit allows users to opt-out of this curation, and instead use
the upstream algorithms. This also allows users to set
Ciphers/KexAlgorithms/Macs themselves without lib.mkForce (and thus
wield NixOS modules to build the list).
Tests have been added to ensure test this new option works.
The env generator allows us to declaratively set environment variables
via the module system for all systemd generators.
This will allow us to drop systemd/0013-inherit-systemd-environment-when-calling-generators.patch
The check derivation only needs the `sshd` binary (which is in the
regular `out` output) and has no need for the validationPackage's other
outputs that contain header files and man pages.
But when the validationPackage is added to the check derivation's
nativeBuildInputs, the latter references all outputs of the former, or
it at least requires the `dev` output to be present at build time.
This means that these outputs always need to present when rebuilding the
system, even when making changes completely unrelated to SSH.
Because the derivations in `system.checks` are only a build time
dependency of the system derivation but are not added to the system's
runtime closure, and a NixOS configuration otherwise only references its
ssh package's `out` output; the other outputs required at build time may
be garbage-collected from the system at any time [^1][^2].
In the best-case scenario, this only results in the download of
unnecessary store paths from a binary cache.
Other scenarios present larger issues:
- when using a custom package, the entire derivation has to be rebuild
(recompilation) just to get the dev output back
- even when the custom package or the system derivation containing it
is stored on a binary cache, it won't have the output unless build
time dependencies are pushed to it as well [^3].
- when there's no binary cache available (e.g. no internet connection),
it might be impossible to rebuild the derivation because of other
missing build time dependencies
- again, the changes triggering a new NixOS build can be unrelated to
SSH and might in themselves not requrie fetching any new store paths
(e.g. updating a simple config file)
[^1]: Unless `keep-outputs = true` is set in nix.conf, but that is a
non-default setting and affects the garbage-collection of other
paths as well
[^2]: There's also the case that the validationPackage is a different
package than the system's SSH package due to cross-compilation,
in which case this fix wouldn't do much because even the `out`
output is not part of the system closure.
[^3]: Users would have to know about it, but it's probably not desirable
in most cases
This commit allows setting the `UsePAM` setting to null. Without it, nix
fails to evaluate with:
```
error: ‘mkIf’ called with a non-Boolean condition
```
Setting it to null means no line for `UsePAM` is written into the
resulting sshd config file. This is needed if openssh is compiled
without PAM support. Otherwise the following log message is produced:
```
rexec line 15: Unsupported option UsePAM
```
This also adds the nixos test openssh-null-pam to set `UsePAM` to null.
This also tests that the above log line is not produced in that case.
If a user doesn't want to enable the SSH daemon, but does want to have
SSH host keys configured for some other reason (e.g. they're used for
host identification in some other way), provide a `generateHostKeys`
setting that will generate the keys without otherwise setting up sshd.
The nixos `sshd.nix` module contains a
mechanism to generate ssh host keys prior to
starting sshd if those host keys are missing.
The option `services.openssh.hostKeys` is used to
configure which host keys should exist or be created.
It also declares the key type and other key-related options.
One of those options is `rounds`.
That one is then forwarded to the
`ssh-keygen` program with the `-a` option.
It defines how many rounds of a key derivation function
are to be used on the key's passphrase before the result
is used to en-/decrypt the private key; cf. ssh-keygen(1).
ssh host keys are passwordless;
they are solely protected by filesystem access modes.
Hence, the `-a` option is irrelevant
and silently ignored by `ssh-keygen`.
The commit at hand therefore removes this option from
the host key generation script and the option examples.
In afeb76d628, sshd.service and
sshd@.service were switched to Type=notify. This apparently works for
sshd.service, but not for sshd@.service. Given that the reason for
this working with sshd.service isn't exactly clear, let's revert it
for both of them for now, and revisit Type=notify later.
The `openssh` and `openssh_hpn` packages are now built without
the Kerberos support by default in an effort to reduce the attack surface.
The Kerberos support is likely used only by a fraction of the total users
(I'm guessing mainly users integrating SSH in an Active Directory env) so
dropping it should not impact too many users. It should also be noted that
the Kerberos/GSSAPI auth is disabled by default in the configuration.
`opensshWithKerberos` and `openssh_hpnWithKerberos` are added in order
to provide an easy migration path for users needing this support.
The `openssh_gssapi` package is kept untouched.
# Motivation
So far it was not possible to configure sshd to allow password authentication only for a specific user. This is because in the generated config a `Match User xxx` section would be required before the global `PasswordAuthentication` is defined, as otherwise the global option always takes precedence.
The same problem occurs with multiple other options under `settings`.
# Done
This PR fixes that issue for all settings by simply allowing them to be overridden with `null`, which leads to a removal of that setting from the config.
The user can then correctly configure user specific settings using extraConfig, like this:
```
Match User user1
PasswordAuthentication yes
Match all
PasswordAuthentication no
```
Motivation: Allow the sshd package to be built differently to the ssh
package (programs.ssh.package). For example, build sshd(1) without
openssl, but built ssh(1) with OpenSSL support.
Set the default to be programs.ssh.package, to preserve compatibility.
these changes were generated with nixq 0.0.2, by running
nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix
two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.
Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
Noticed that issue while reviewing #275633: when declaring
`ListenAddress host` without a port, all ports declared by
`Port`/`cfg.ports` will be used with `host` according to
`sshd_config(5)`.
However, if this is done and socket activation is used, only a socket
for port 22 is created instead of a sockets for each port from
`Port`/`cfg.ports`. This patch corrects that behavior.
Also added a regression test for this case.
Tom Fitzhenry