lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

ssh-ca-vault: by default enable user matches

Browse source
This commit is contained in:
Luke Granger-Brown 2022-03-11 22:31:57 +00:00
parent ae97fddae2
commit f15e112da7
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
ops/nixos/lib/ssh-ca-vault.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: Apache-2.0
{ config, lib, ... }:
{ config, lib, pkgs, ... }:
let
inherit (lib) listToAttrs nameValuePair mkAfter concatMapStrings;
@ -30,9 +30,18 @@ in {
services.openssh.extraConfig = concatMapStrings (c: "HostCertificate ${c}\n") signedPaths + ''
TrustedUserCAKeys ${../../secrets/client-ca.pub}
AuthorizedPrincipalsCommand /etc/ssh/authorized_principals_cmd %u
AuthorizedPrincipalsCommandUser sshd
AuthorizedPrincipalsFile %h/.ssh/authorized_principals
AuthorizedPrincipalsFile /etc/ssh/authorized_principals.d/%u
'';
environment.etc."ssh/authorized_principals_cmd" = {
mode = "0555";
text = ''
#!${pkgs.stdenv.shell}
echo "$1"
'';
};
environment.etc."ssh/authorized_principals.d/root".text = ''
lukegb