Re: openssh pubkeys as part of system config

[ng0 <contact.ng0@cryptolab.net>]

Ludovic Courtès transcribed 1.1K bytes:
> Hi,
> 
> Chris Marusich <cmmarusich@gmail.com> skribis:
> 
> > ng0 <contact.ng0@cryptolab.net> writes:
> >
> >> Hi,
> >>
> >> I will soon start to assemble an GuixSD system image for IN-Berlin
> >> virtual servers.
> >> I know bayfront uses a module which defines lsh pubkeys for user 'root'
> >> (?) and makes them part of the system generation.
> >>
> >> For IN-Berlin (and probably other hosters) it would help if there was a
> >> way to define openssh pubkeys in the system config.
> >> I know I could just generate an image, make it writable and put my key
> >> into /root/.ssh/authorized_keys, but it would be better if this would be
> >> possible to define directly.
> >>
> >> Has someone looked into this before?
> >
> > I only know of this discussion:
> >
> > https://lists.gnu.org/archive/html/help-guix/2016-11/msg00075.html
> 
> For bayfront, we have a module to declare authorized publish SSH keys,
> but that currently relies on lshd rather than sshd:
> 
>   https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/hydra/modules/sysadmin/people.scm
> 
> It’s a common need so we should move it to Guix proper and implement the
> same thing for OpenSSH.
> 
> HTH,
> Ludo’.
> 

I've seen the module, and tried to make use of it personally, but LSH
feels unfinished when you've used OpenSSH for years. For example the way
lsh suggests you to replicate 'scp' of OpenSSH.

I only know of a handful of hosters who deal with SSH keys directly, so
I don't know how common this case is.
Nevertheless I think many people would appreciate if this were added to
Guix 'canon'.