Worktree ipa client module #80

Merged

beatzaplenty merged 1 commits from worktree-ipa-client-module into main

2026-07-28 00:13:09 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	f46ae18672	fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check Check NixOS configurations / eval-hosts (pull_request) Failing after 9m43s Details OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every path component of the command binary for group/world-write permission. /nix/store is 1775 (group-writable by nixbld), so sshd silently skips the command for any binary in the Nix store — causing IPA pubkey auth to silently fail with no diagnostic. Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles (C+ copies the file rather than symlinking, so the path at runtime is root-owned/755 throughout), and point AuthorizedKeysCommand at the copy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 10:08:57 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

f46ae18672

fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check

Check NixOS configurations / eval-hosts (pull_request) Failing after 9m43s

Details

OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every
path component of the command binary for group/world-write permission.
/nix/store is 1775 (group-writable by nixbld), so sshd silently skips
the command for any binary in the Nix store — causing IPA pubkey auth to
silently fail with no diagnostic.

Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles
(C+ copies the file rather than symlinking, so the path at runtime is
root-owned/755 throughout), and point AuthorizedKeysCommand at the copy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 10:08:57 +10:00