From dbe59eca8402523b82d406a63eccb62d82d964ae Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Thu, 12 Mar 2020 10:58:50 -0400 Subject: nixos/sshd: add authorizedKeysCommand and authorizedKeysCommandUser options --- nixos/modules/services/networking/ssh/sshd.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'nixos/modules/services/networking/ssh') diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index b0e2e303cbc..2069ec178aa 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -238,6 +238,26 @@ in description = "Files from which authorized keys are read."; }; + authorizedKeysCommand = mkOption { + type = types.str; + default = "none"; + description = '' + Specifies a program to be used to look up the user's public + keys. The program must be owned by root, not writable by group + or others and specified by an absolute path. + ''; + }; + + authorizedKeysCommandUser = mkOption { + type = types.str; + default = "nobody"; + description = '' + Specifies the user under whose account the AuthorizedKeysCommand + is run. It is recommended to use a dedicated user that has no + other role on the host than running authorized keys commands. + ''; + }; + kexAlgorithms = mkOption { type = types.listOf types.str; default = [ @@ -485,6 +505,8 @@ in PrintMotd no # handled by pam_motd AuthorizedKeysFile ${toString cfg.authorizedKeysFiles} + AuthorizedKeysCommand ${cfg.authorizedKeysCommand} + AuthorizedKeysCommandUser ${cfg.authorizedKeysCommandUser} ${flip concatMapStrings cfg.hostKeys (k: '' HostKey ${k.path} -- cgit 1.4.1