Commit Graph

20 Commits

Author SHA1 Message Date
Johan Thomsen
8f5949fd46 nixos/initrd-ssh: set more defensive pemissions on sshd test key
It looks like the test sshd key can never be used, because of too open
permissions. My guess is that the current test script works fine once
the user defined ssh-key has been copied into initrd.

At "nixos-install" however, the user specified host key is not present
in initrd yet and validation fails.

fixes #91486
2020-09-30 15:47:49 +02:00
Finn Behrens
daa0dfe4f4 nixos/initrd-ssh: add extraConfig Options 2020-05-03 20:11:52 +02:00
Emily
8a37c3dd1a nixos/initrd-ssh: fix typo in docs 2020-04-11 16:19:48 +01:00
B YI
07bc7b971d
nixos/initrd-ssh: fix typo (#84719) 2020-04-08 17:04:29 +02:00
Emily
d930466b77 nixos/initrd-ssh: switch from Dropbear to OpenSSH
Dropbear lags behind OpenSSH significantly in both support for modern
key formats like `ssh-ed25519`, let alone the recently-introduced
U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched
my `authorizedKeys` over to it and promptly locked myself out of my
server's initrd SSH, breaking reboots), as well as security features
like multiprocess isolation. Using the same SSH daemon for stage-1 and
the main system ensures key formats will always remain compatible, as
well as more conveniently allowing the sharing of configuration and
host keys.

The main reason to use Dropbear over OpenSSH would be initrd space
concerns, but NixOS initrds are already large (17 MiB currently on my
server), and the size difference between the two isn't huge (the test's
initrd goes from 9.7 MiB to 12 MiB with this change). If the size is
still a problem, then it would be easy to shrink sshd down to a few
hundred kilobytes by using an initrd-specific build that uses musl and
disables things like Kerberos support.

This passes the test and works on my server, but more rigorous testing
and review from people who use initrd SSH would be appreciated!
2020-03-25 08:26:50 +00:00
Erik Arvstedt
215c91d79e nixos/initrd: improve descriptions
The improved lspci command shows all available ethernet controllers and
their kernel modules. Previously, the user had to provide the slot name
of a specific device.
2018-10-02 17:38:06 +02:00
Florian Klink
fff5923686 nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
Shea Levy
f2937b7485
initrd-ssh: Fix for new dropbear version.
For some reason 2018.76 dropped the -m flag.
2018-03-01 21:21:27 -05:00
volth
af6fc78f5d
initrd-ssh: generate hostkeys if absent 2017-12-03 02:27:29 +00:00
Shea Levy
3a26d09e15 initrd-ssh: Use initrd secrets for host keys 2017-04-02 16:33:37 -04:00
Jörg Thalheim
7ad01f5f0c initrd-ssh: fix authorized_key generation with multiple keys
multiple entries should be separated by newline
2016-11-16 14:47:37 +00:00
Nikolay Amiantov
00f444d0c1 initrd-ssh service: check that authorized keys are added 2016-09-20 12:16:10 +03:00
Nikolay Amiantov
1df4dd6bf5 initrd-ssh service: ensure that keys got copied into initrd
Fixes #17927.
2016-08-23 16:20:26 +03:00
Nikolay Amiantov
90ad879753 nixos stage-1: unconditionally mount /dev/pts 2016-07-12 22:22:28 +03:00
Nikolay Amiantov
53b8852498 initrd-ssh service: add assertions for host keys 2016-05-20 23:34:28 +03:00
Nikolay Amiantov
17e4803de7 initrd-ssh service: fix build 2016-05-07 15:38:46 +03:00
Nikolay Amiantov
1dce7c0b82 initrd-ssh module: don't check if network is up
We already do this in initrd-network.
2016-02-03 16:37:10 +03:00
Nikolay Amiantov
1d70e2fb75 initrd modules: move passwd and nsswitch back to initrd-ssh
Partially reverts commit 901163c0c7.
This has broken remote SSH into initrd because ${cfg.shell} is not
expanded. Also, nsswitch is useless without libnss_files.so which
are installed by initrd-ssh.
2016-02-03 14:56:55 +03:00
Nikolay Amiantov
815ff00ee0 initrd-ssh module: enable only if initrd network is enabled 2016-02-03 14:55:52 +03:00
Eelco Dolstra
901163c0c7 Split the initrd sshd support into a separate module
Also, drop boot.initrd.postEarlyDeviceCommands since preLVMCommands
should work fine.
2016-02-02 19:59:27 +01:00