From: "Ludovic Courtès" <ludo@gnu.org>
To: Oleg Pykhalov <go.wigust@gmail.com>
Cc: Edouard Klein <edk@beaver-labs.com>,
55359@debbugs.gnu.org, help-guix@gnu.org
Subject: Re: bug#55359: How do I extend openssh-service-type ?
Date: Thu, 26 May 2022 16:44:44 +0200 [thread overview]
Message-ID: <87ee0gfj4z.fsf@gnu.org> (raw)
In-Reply-To: <87r150o6zj.fsf@gmail.com> (Oleg Pykhalov's message of "Wed, 11 May 2022 10:37:04 +0300")
Hi,
Oleg Pykhalov <go.wigust@gmail.com> skribis:
>> (service-extension openssh-service-type
>> (const `(("charlie"
>> ,(local-file "charlie.pub")))))
>> #+end_quote
>
> […]
>
> Seems like extend-openssh-authorized-keys procedure does not use keys
> argument. We could fix it like:
For the record, this bug (dismissing the ‘keys’ argument) was introduced
in b4b2bbf4fb74c9f3e93d64863ab9b38957494b49 (Oct. 2021).
How come nobody noticed then?
The reason is that starting from
b4b2bbf4fb74c9f3e93d64863ab9b38957494b49, ‘authorized-key-directory’
would create an empty directory. That directory would then be copied by
‘openssh-activation’ to /etc/ssh/authorized_keys.d; since
/etc/ssh/authorized_keys.d would typically already contain the relevant
keys, nothing bad would happen.
Oleg’s commit 1f29ed4a812f86c45e2d9c37fd9f80f6d0418293 introduced
another bug though: we’d create an authorized-key directory that
included keys brought by extensions, but each of these files would be
empty (because ‘extend-openssh-authorized-keys’ would dismiss key files
associated with user names), which could lock yourself out.
Fixed in 0dc63ce519c5f98b2186d1871176e2fac3a6926b. Reconfiguration
recommended before you’re locked out!
Thanks,
Ludo’.
next prev parent reply other threads:[~2022-05-26 14:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-10 21:07 How do I extend openssh-service-type ? Edouard Klein
2022-05-11 7:37 ` bug#55359: " Oleg Pykhalov
2022-05-25 12:06 ` Ludovic Courtès
2022-05-26 14:44 ` Ludovic Courtès [this message]
2022-05-31 17:05 ` Edouard Klein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ee0gfj4z.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=55359@debbugs.gnu.org \
--cc=edk@beaver-labs.com \
--cc=go.wigust@gmail.com \
--cc=help-guix@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).