Worktree ipa client module #80

Merged

beatzaplenty merged 1 commits from worktree-ipa-client-module into main 2026-07-28 00:13:09 +00:00

Conversation 0 Commits 1 Files Changed 1

+12 -1

beatzaplenty commented 2026-07-27 23:47:37 +00:00

Owner

Copy Link

Copy Source

No description provided.

beatzaplenty added 2 commits 2026-07-27 23:47:38 +00:00

feat(ipa): add AuthorizedKeysCommand + enroll tailscale-router ... 5487490b8e

- modules/ipa/client.nix: add AuthorizedKeysCommand so sshd fetches SSH
  public keys from IPA via sss_ssh_authorizedkeys, enabling pubkey login
  without per-host authorized_keys files

- hosts/tailscale-router/host.nix: add IPA client module + networking.domain
  so SSSD runs and wayne can authenticate on this host

- secrets/tailscale-router.keytab: sops-encrypted keytab for
  tailscale-router.sweet.home (generated by create-nixos-ipa-host-account.sh)

- .sops.yaml: creation rule for secrets/tailscale-router.keytab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(ipa): create home dir on first login + AuthorizedKeysCommand ... 97019205da

- security.pam.services.sshd.makeHomeDir: IPA users have no pre-created
  home directory on the host; without this, sshd opens a session to a
  missing directory and resets the connection immediately after auth
- AuthorizedKeysCommand was already added in previous commit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty added 1 commit 2026-07-28 00:09:05 +00:00

fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check ... f46ae18672

OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every
path component of the command binary for group/world-write permission.
/nix/store is 1775 (group-writable by nixbld), so sshd silently skips
the command for any binary in the Nix store — causing IPA pubkey auth to
silently fail with no diagnostic.

Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles
(C+ copies the file rather than symlinking, so the path at runtime is
root-owned/755 throughout), and point AuthorizedKeysCommand at the copy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty merged commit e9fcbbbbcb into main 2026-07-28 00:13:09 +00:00

This repo is archived. You cannot comment on pull requests.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

beatzaplenty

No Assignees

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#80