beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ipa): stream keytab via sudo cat instead of scp
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m25s
Details

Browse Source 
ipa-getkeytab runs as root via sudo so the temp file is root-owned;
scp as wayne gets Permission denied. Pipe through `sudo cat` over SSH
instead, which reads as root but writes locally as the invoking user.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-28 09:08:19 +10:00
co-authored by Claude Sonnet 4.6
parent 27a8c7fad9
commit f6f30c675f
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ipa/create-nixos-ipa-host-account.sh
+4 -3
View File
@@ -219,10 +219,11 @@ log "Fetching keytab for host/${FQDN}"
dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'" dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'"
if $DRY_RUN; then if $DRY_RUN; then
echo "[dry-run] Would scp ${DC_USER}@${DC_HOST}:${DC_TMP} ${KEYTAB_SECRET}" echo "[dry-run] Would stream ${DC_USER}@${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
else else
logn "Copying keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab" logn "Streaming keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
scp "${DC_USER}@${DC_HOST}:${DC_TMP}" "${KEYTAB_SECRET}" # scp can't read a root-owned temp file as wayne; pipe through sudo cat instead.
ssh "${DC_USER}@${DC_HOST}" "sudo cat '${DC_TMP}'" > "${KEYTAB_SECRET}"
logn "Removing temp file on ${DC_HOST}" logn "Removing temp file on ${DC_HOST}"
dc_run "sudo rm -f '${DC_TMP}'" dc_run "sudo rm -f '${DC_TMP}'"