colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tests/openssh: use upstream's algorithms in "no openssl" example

Browse Source 
When I initially wrote this test, I wasn't aware that services.openssh
could opt into using OpenSSH's default algorithms by just setting the
relevant settings to null.

That's a better approach since:
* it's a simpler setting for this test to have to worry about
* it introduces test coverage for the null case
* the null case should be demonstrated as an example for those that
  want to compile without OpenSSL
This commit is contained in:
Tom Fitzhenry 2024-06-06 23:06:29 +10:00 committed by tomf
parent 2542605888
commit 9e4e5d96f1
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/tests/openssh.nix
View File

@ -120,12 +120,14 @@ in {
{ type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
]; ];
settings = { settings = {
# Must not specify the OpenSSL provided algorithms. # Since this test is against an OpenSSH-without-OpenSSL,
Ciphers = [ "chacha20-poly1305@openssh.com" ]; # we have to override NixOS's defaults ciphers (which require OpenSSL)
KexAlgorithms = [ # and instead set these to null, which will mean OpenSSH uses its defaults.
"curve25519-sha256" # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
"curve25519-sha256@libssh.org" # without OpenSSL.
]; Ciphers = null;
KexAlgorithms = null;
Macs = null;
}; };
}; };
users.users.root.openssh.authorizedKeys.keys = [ users.users.root.openssh.authorizedKeys.keys = [