beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ipa): stream keytab via sudo cat instead of scp #78

Merged
beatzaplenty merged 1 commits from worktree-ipa-client-module into main 2026-07-27 23:14:41 +00:00
Conversation 0 Commits 1 Files Changed 1
+4 -3
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ipa/create-nixos-ipa-host-account.sh
+4 -3
View File
@@ -219,10 +219,11 @@ log "Fetching keytab for host/${FQDN}"
dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'" dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'"
if $DRY_RUN; then if $DRY_RUN; then
echo "[dry-run] Would scp ${DC_USER}@${DC_HOST}:${DC_TMP} ${KEYTAB_SECRET}" echo "[dry-run] Would stream ${DC_USER}@${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
else else
logn "Copying keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab" logn "Streaming keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
scp "${DC_USER}@${DC_HOST}:${DC_TMP}" "${KEYTAB_SECRET}" # scp can't read a root-owned temp file as wayne; pipe through sudo cat instead.
ssh "${DC_USER}@${DC_HOST}" "sudo cat '${DC_TMP}'" > "${KEYTAB_SECRET}"
logn "Removing temp file on ${DC_HOST}" logn "Removing temp file on ${DC_HOST}"
dc_run "sudo rm -f '${DC_TMP}'" dc_run "sudo rm -f '${DC_TMP}'"