diff options
author | Maximilian Bosch <maximilian@mbosch.me> | 2019-04-02 00:30:43 +0200 |
---|---|---|
committer | Maximilian Bosch <maximilian@mbosch.me> | 2019-05-24 20:16:53 +0200 |
commit | 00a52224997a32cd95a43c40e94e20d53bb52628 (patch) | |
tree | c56b908d5ae23552d738148701efdc95bab65a82 /nixos | |
parent | 92e5745383a894286a62498cae45fa1b32563d97 (diff) | |
download | nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar.gz nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar.bz2 nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar.lz nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar.xz nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.tar.zst nixpkgs-00a52224997a32cd95a43c40e94e20d53bb52628.zip |
nixos/sshd: validate ssh configs during build
With `sshd -t` config validation for SSH is possible. Until now, the config generated by Nix was applied without any validation (which is especially a problem for advanced config like `Match` blocks). When deploying broken ssh config with nixops to a remote machine it gets even harder to fix the problem due to the broken ssh that makes reverts with nixops impossible. This change performs the validation in a Nix build environment by creating a store path with the config and generating a mocked host key which seems to be needed for the validation. With a broken config, the deployment already fails during the build of the derivation. The original attempt was done in #56345 by adding a submodule for Match groups to make it harder screwing that up, however that made the module far more complex and config should be described in an easier way as described in NixOS/rfcs#42.
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/services/networking/ssh/sshd.nix | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index b9b5d40c457..1be9a3919b9 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -4,6 +4,15 @@ with lib; let + sshconf = pkgs.runCommand "sshd.conf-validated" { nativeBuildInputs = [ cfgc.package ]; } '' + cat >$out <<EOL + ${cfg.extraConfig} + EOL + + ssh-keygen -f mock-hostkey -N "" + sshd -t -f $out -h mock-hostkey + ''; + cfg = config.services.openssh; cfgc = config.programs.ssh; @@ -339,7 +348,7 @@ in environment.etc = authKeysFiles // { "ssh/moduli".source = cfg.moduliFile; - "ssh/sshd_config".text = cfg.extraConfig; + "ssh/sshd_config".source = sshconf; }; systemd = |