From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: openssh pubkeys as part of system config Date: Sat, 18 Mar 2017 16:50:05 +0000 Message-ID: <20170318165005.biqdtl43lzgxilpr@abyayala> References: <20170316095102.iayousse4pcoajkv@abyayala> <8760j8babg.fsf@gmail.com> <877f3m65lg.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:36824) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cpGTz-0007Cx-Az for guix-devel@gnu.org; Sat, 18 Mar 2017 11:41:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cpGTv-0003Y5-Da for guix-devel@gnu.org; Sat, 18 Mar 2017 11:41:31 -0400 Content-Disposition: inline In-Reply-To: <877f3m65lg.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: guix-devel@gnu.org Ludovic Court=C3=A8s transcribed 1.1K bytes: > Hi, >=20 > Chris Marusich skribis: >=20 > > ng0 writes: > > > >> Hi, > >> > >> I will soon start to assemble an GuixSD system image for IN-Berlin > >> virtual servers. > >> I know bayfront uses a module which defines lsh pubkeys for user 'ro= ot' > >> (?) and makes them part of the system generation. > >> > >> For IN-Berlin (and probably other hosters) it would help if there wa= s a > >> way to define openssh pubkeys in the system config. > >> I know I could just generate an image, make it writable and put my k= ey > >> into /root/.ssh/authorized_keys, but it would be better if this woul= d be > >> possible to define directly. > >> > >> Has someone looked into this before? > > > > I only know of this discussion: > > > > https://lists.gnu.org/archive/html/help-guix/2016-11/msg00075.html >=20 > For bayfront, we have a module to declare authorized publish SSH keys, > but that currently relies on lshd rather than sshd: >=20 > https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/hydra/mod= ules/sysadmin/people.scm >=20 > It=E2=80=99s a common need so we should move it to Guix proper and impl= ement the > same thing for OpenSSH. >=20 > HTH, > Ludo=E2=80=99. >=20 I've seen the module, and tried to make use of it personally, but LSH feels unfinished when you've used OpenSSH for years. For example the way lsh suggests you to replicate 'scp' of OpenSSH. I only know of a handful of hosters who deal with SSH keys directly, so I don't know how common this case is. Nevertheless I think many people would appreciate if this were added to Guix 'canon'.