From f46ae186721083a48ad21be9cfa133e828c2fd2d Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 10:08:57 +1000 Subject: [PATCH] fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every path component of the command binary for group/world-write permission. /nix/store is 1775 (group-writable by nixbld), so sshd silently skips the command for any binary in the Nix store — causing IPA pubkey auth to silently fail with no diagnostic. Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles (C+ copies the file rather than symlinking, so the path at runtime is root-owned/755 throughout), and point AuthorizedKeysCommand at the copy. Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index 2278fe7..3e543f2 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -63,8 +63,19 @@ in # Fetch SSH public keys from IPA so users can log in with the key stored # in their IPA profile rather than needing ~/.ssh/authorized_keys on every # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP). + # + # /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects + # AuthorizedKeysCommand binaries whose path contains any group-writable + # component, silently skipping the command. Copy to /usr/local/bin (all + # components root-owned, 755) so the path passes sshd's safety check. + systemd.tmpfiles.rules = [ + "d /usr/local 0755 root root - -" + "d /usr/local/bin 0755 root root - -" + "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys" + ]; + services.openssh.extraConfig = '' - AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u + AuthorizedKeysCommand /usr/local/bin/sss_ssh_authorizedkeys %u AuthorizedKeysCommandUser nobody ''; -- 2.54.0