beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Worktree ipa client module #80

Merged
beatzaplenty merged 1 commits from worktree-ipa-client-module into main 2026-07-28 00:13:09 +00:00
Conversation 0 Commits 1 Files Changed 1
+12 -1
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ipa/client.nix
+12 -1
View File
@@ -63,8 +63,19 @@ in
# Fetch SSH public keys from IPA so users can log in with the key stored # Fetch SSH public keys from IPA so users can log in with the key stored
# in their IPA profile rather than needing ~/.ssh/authorized_keys on every # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
# host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP). # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
#
# /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects
# AuthorizedKeysCommand binaries whose path contains any group-writable
# component, silently skipping the command. Copy to /usr/local/bin (all
# components root-owned, 755) so the path passes sshd's safety check.
systemd.tmpfiles.rules = [
"d /usr/local 0755 root root - -"
"d /usr/local/bin 0755 root root - -"
"C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
];
services.openssh.extraConfig = '' services.openssh.extraConfig = ''
AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u AuthorizedKeysCommand /usr/local/bin/sss_ssh_authorizedkeys %u
AuthorizedKeysCommandUser nobody AuthorizedKeysCommandUser nobody
''; '';