openssh pubkeys as part of system config

openssh pubkeys as part of system config

[ng0]

Hi,

I will soon start to assemble an GuixSD system image for IN-Berlin
virtual servers.
I know bayfront uses a module which defines lsh pubkeys for user 'root'
(?) and makes them part of the system generation.

For IN-Berlin (and probably other hosters) it would help if there was a
way to define openssh pubkeys in the system config.
I know I could just generate an image, make it writable and put my key
into /root/.ssh/authorized_keys, but it would be better if this would be
possible to define directly.

Has someone looked into this before?

Re: openssh pubkeys as part of system config

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 858 bytes --]

ng0 <contact.ng0@cryptolab.net> writes:

> Hi,
>
> I will soon start to assemble an GuixSD system image for IN-Berlin
> virtual servers.
> I know bayfront uses a module which defines lsh pubkeys for user 'root'
> (?) and makes them part of the system generation.
>
> For IN-Berlin (and probably other hosters) it would help if there was a
> way to define openssh pubkeys in the system config.
> I know I could just generate an image, make it writable and put my key
> into /root/.ssh/authorized_keys, but it would be better if this would be
> possible to define directly.
>
> Has someone looked into this before?

I only know of this discussion:

https://lists.gnu.org/archive/html/help-guix/2016-11/msg00075.html

Try searching for the words "authorized" and "key".  The link to IRC at
the very bottom might be helpful.

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: openssh pubkeys as part of system config

[Ludovic Courtès]

Hi,

Chris Marusich <cmmarusich@gmail.com> skribis:

> ng0 <contact.ng0@cryptolab.net> writes:
>
>> Hi,
>>
>> I will soon start to assemble an GuixSD system image for IN-Berlin
>> virtual servers.
>> I know bayfront uses a module which defines lsh pubkeys for user 'root'
>> (?) and makes them part of the system generation.
>>
>> For IN-Berlin (and probably other hosters) it would help if there was a
>> way to define openssh pubkeys in the system config.
>> I know I could just generate an image, make it writable and put my key
>> into /root/.ssh/authorized_keys, but it would be better if this would be
>> possible to define directly.
>>
>> Has someone looked into this before?
>
> I only know of this discussion:
>
> https://lists.gnu.org/archive/html/help-guix/2016-11/msg00075.html

For bayfront, we have a module to declare authorized publish SSH keys,
but that currently relies on lshd rather than sshd:

  https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/hydra/modules/sysadmin/people.scm

It’s a common need so we should move it to Guix proper and implement the
same thing for OpenSSH.

HTH,
Ludo’.

Re: openssh pubkeys as part of system config

[ng0]

Ludovic Courtès transcribed 1.1K bytes:
> Hi,
> 
> Chris Marusich <cmmarusich@gmail.com> skribis:
> 
> > ng0 <contact.ng0@cryptolab.net> writes:
> >
> >> Hi,
> >>
> >> I will soon start to assemble an GuixSD system image for IN-Berlin
> >> virtual servers.
> >> I know bayfront uses a module which defines lsh pubkeys for user 'root'
> >> (?) and makes them part of the system generation.
> >>
> >> For IN-Berlin (and probably other hosters) it would help if there was a
> >> way to define openssh pubkeys in the system config.
> >> I know I could just generate an image, make it writable and put my key
> >> into /root/.ssh/authorized_keys, but it would be better if this would be
> >> possible to define directly.
> >>
> >> Has someone looked into this before?
> >
> > I only know of this discussion:
> >
> > https://lists.gnu.org/archive/html/help-guix/2016-11/msg00075.html
> 
> For bayfront, we have a module to declare authorized publish SSH keys,
> but that currently relies on lshd rather than sshd:
> 
>   https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/hydra/modules/sysadmin/people.scm
> 
> It’s a common need so we should move it to Guix proper and implement the
> same thing for OpenSSH.
> 
> HTH,
> Ludo’.
> 

I've seen the module, and tried to make use of it personally, but LSH
feels unfinished when you've used OpenSSH for years. For example the way
lsh suggests you to replicate 'scp' of OpenSSH.

I only know of a handful of hosters who deal with SSH keys directly, so
I don't know how common this case is.
Nevertheless I think many people would appreciate if this were added to
Guix 'canon'.