From f6f30c675f86a4ffb627e0464f6dab6db561a96d Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 09:08:19 +1000 Subject: [PATCH] fix(ipa): stream keytab via sudo cat instead of scp ipa-getkeytab runs as root via sudo so the temp file is root-owned; scp as wayne gets Permission denied. Pipe through `sudo cat` over SSH instead, which reads as root but writes locally as the invoking user. Co-Authored-By: Claude Sonnet 4.6 --- scripts/ipa/create-nixos-ipa-host-account.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/ipa/create-nixos-ipa-host-account.sh b/scripts/ipa/create-nixos-ipa-host-account.sh index ceb3bcb..a941912 100755 --- a/scripts/ipa/create-nixos-ipa-host-account.sh +++ b/scripts/ipa/create-nixos-ipa-host-account.sh @@ -219,10 +219,11 @@ log "Fetching keytab for host/${FQDN}" dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'" if $DRY_RUN; then - echo "[dry-run] Would scp ${DC_USER}@${DC_HOST}:${DC_TMP} ${KEYTAB_SECRET}" + echo "[dry-run] Would stream ${DC_USER}@${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab" else - logn "Copying keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab" - scp "${DC_USER}@${DC_HOST}:${DC_TMP}" "${KEYTAB_SECRET}" + logn "Streaming keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab" + # scp can't read a root-owned temp file as wayne; pipe through sudo cat instead. + ssh "${DC_USER}@${DC_HOST}" "sudo cat '${DC_TMP}'" > "${KEYTAB_SECRET}" logn "Removing temp file on ${DC_HOST}" dc_run "sudo rm -f '${DC_TMP}'"