ffedee6ed5
This has some advantages: * You get ssh-agent regardless of how you logged in. Previously it was only started for X11 sessions. * All sessions of a user share the same agent. So if you added a key on tty1, it will also be available on tty2. * Systemd will restart ssh-agent if it dies. * $SSH_AUTH_SOCK now points to the /run/user/<uid> directory, which is more secure than /tmp. For bonus points, we should patch ssh-agent to support socket-based activation...
109 lines
3.4 KiB
Nix
109 lines
3.4 KiB
Nix
# Global configuration for the SSH client.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let cfg = config.programs.ssh;
|
|
cfgd = config.services.openssh;
|
|
|
|
in
|
|
{
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
programs.ssh = {
|
|
|
|
forwardX11 = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to request X11 forwarding on outgoing connections by default.
|
|
This is useful for running graphical programs on the remote machine and have them display to your local X11 server.
|
|
Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two.
|
|
Note: there are some security risks to forwarding an X11 connection.
|
|
NixOS's X server is built with the SECURITY extension, which prevents some obvious attacks.
|
|
To enable or disable forwarding on a per-connection basis, see the -X and -x options to ssh.
|
|
The -Y option to ssh enables trusted forwarding, which bypasses the SECURITY extension.
|
|
'';
|
|
};
|
|
|
|
setXAuthLocation = mkOption {
|
|
type = types.bool;
|
|
default = config.services.xserver.enable;
|
|
description = ''
|
|
Whether to set the path to <command>xauth</command> for X11-forwarded connections.
|
|
This causes a dependency on X11 packages.
|
|
'';
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = ''
|
|
Extra configuration text appended to <filename>ssh_config</filename>.
|
|
See <citerefentry><refentrytitle>ssh_config</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
for help.
|
|
'';
|
|
};
|
|
|
|
startAgent = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = ''
|
|
Whether to start the OpenSSH agent when you log in. The OpenSSH agent
|
|
remembers private keys for you so that you don't have to type in
|
|
passphrases every time you make an SSH connection. Use
|
|
<command>ssh-add</command> to add a key to the agent.
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
config = {
|
|
|
|
assertions = singleton
|
|
{ assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
|
|
message = "cannot enable X11 forwarding without setting XAuth location";
|
|
};
|
|
|
|
environment.etc =
|
|
[ { # SSH configuration. Slight duplication of the sshd_config
|
|
# generation in the sshd service.
|
|
source = pkgs.writeText "ssh_config" ''
|
|
AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
|
|
${optionalString cfg.setXAuthLocation ''
|
|
XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
|
|
''}
|
|
ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}
|
|
${cfg.extraConfig}
|
|
'';
|
|
target = "ssh/ssh_config";
|
|
}
|
|
];
|
|
|
|
# FIXME: this should really be socket-activated for über-awesomeness.
|
|
systemd.user.services.ssh-agent =
|
|
{ enable = cfg.startAgent;
|
|
description = "SSH Agent";
|
|
wantedBy = [ "default.target" ];
|
|
serviceConfig =
|
|
{ ExecStart = "${pkgs.openssh}/bin/ssh-agent -a %t/ssh-agent";
|
|
Type = "forking";
|
|
Restart = "on-failure";
|
|
};
|
|
};
|
|
|
|
environment.extraInit = optionalString cfg.startAgent
|
|
''
|
|
if [ -z "$SSH_AUTH_SOCK" -a -n "$XDG_RUNTIME_DIR" ]; then
|
|
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"
|
|
fi
|
|
'';
|
|
|
|
};
|
|
}
|