colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tests/openssh: use upstream's algorithms in "no openssl" example

Browse Source 
When I initially wrote this test, I wasn't aware that services.openssh
could opt into using OpenSSH's default algorithms by just setting the
relevant settings to null.

That's a better approach since:
* it's a simpler setting for this test to have to worry about
* it introduces test coverage for the null case
* the null case should be demonstrated as an example for those that
  want to compile without OpenSSL
This commit is contained in:
Tom Fitzhenry 2024-06-06 23:06:29 +10:00 committed by tomf
parent 2542605888
commit 9e4e5d96f1
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/tests/openssh.nix
View File

@ -120,12 +120,14 @@ in {
{ type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
];
settings = {
# Must not specify the OpenSSL provided algorithms.
Ciphers = [ "chacha20-poly1305@openssh.com" ];
KexAlgorithms = [
"curve25519-sha256"
"curve25519-sha256@libssh.org"
];
# Since this test is against an OpenSSH-without-OpenSSL,
# we have to override NixOS's defaults ciphers (which require OpenSSL)
# and instead set these to null, which will mean OpenSSH uses its defaults.
# Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
# without OpenSSL.
Ciphers = null;
KexAlgorithms = null;
Macs = null;
};
};
users.users.root.openssh.authorizedKeys.keys = [