palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Actions Projects Releases Wiki Activity

fixing init ssh

Browse source
This commit is contained in:
Ingolf Wagner 2022-01-18 20:21:03 +01:00
parent dd75b61992
commit 766f4a8b4b
Signed by: palo
GPG key ID: 76BF5F1928B9618B
3 changed files with 36 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
nixos/system/all/sshd-known-hosts-bootup.nix
View file

@ -3,31 +3,36 @@ with lib;
let let
computers = { computers = {
#workhorse = { pepe = {
# onionId = fileContents ../../private_assets/onion_id_workhorse; onionId = fileContents ../../private_assets/onion_id_pepe;
# publicKey = # SHA256:aOZbqpgc5CcTNtRAzjuG/0BQZ9MF5c9u/N+UC88y8kI
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/I4JBA1HHTH2xsrEM7xtxkhRDE42lZcBrdBvN46WTx"; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5K4UHD8cIcXB33UiOj5vyXJj+4CyyiLFDMwcyad92a";
#}; };
#porani = {
# onionId = fileContents ../../private_assets/onion_id_porani;
# publicKey =
# "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGFaTRGqMd/rKpyMUP6wVbgiWFOUvUV2qS/B5Xe02UUch/wxR4fTCY+vnzku5K0V/qqJpjYLgHotwZFqO/8lFu4=";
#};
}; };
in in
{ {
services.openssh.knownHosts = mapAttrs' services.openssh.knownHosts = {
"robi-init-ssh" = {
hostNames = [
"[robi]:2222"
"[144.76.13.147]:2222"
];
# SHA256:rhvbJ84cPXXezaoJiY7tFsG8CJxI2F/lLKz8q+xUW+g
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKQ7XB6Cs9FJmHkuZ9ihbj76WsK0uJBh882ceyKaaKJ";
};
} // (mapAttrs'
(name: (name:
{ onionId, publicKey, ... }: { { onionId, publicKey, ... }: {
name = "${name}-init-ssh"; name = "${name}-init-ssh";
value = { value = {
hostNames = [ onionId ]; hostNames = [ "[${onionId}]:2222" ];
inherit publicKey; inherit publicKey;
}; };
}) })
computers; computers);
environment.systemPackages = environment.systemPackages =
let let
@ -36,7 +41,7 @@ in
(name: (name:
{ onionId, ... }: { onionId, ... }:
pkgs.writers.writeDashBin "ssh-boot-to-${name}" '' pkgs.writers.writeDashBin "ssh-boot-to-${name}" ''
${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 23 ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
'') '')
computers; computers;
@ -44,7 +49,7 @@ in
(name: (name:
{ onionId, ... }: { onionId, ... }:
pkgs.writers.writeDashBin "unlock-boot-${name}" '' pkgs.writers.writeDashBin "unlock-boot-${name}" ''
${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 23 ' ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222 '
echo -n "enter password : " echo -n "enter password : "
read password read password
echo "$password" > /crypt-ramfs/passphrase echo "$password" > /crypt-ramfs/passphrase

25
nixos/system/all/sshd-known-hosts-private.nix
View file

@ -2,6 +2,16 @@
{ config, lib, ... }: { { config, lib, ... }: {
services.openssh.knownHosts = { services.openssh.knownHosts = {
#"robi_init" = {
# hostNames = [
# "robi:2222"
# "144.76.13.147:2222"
# ];
# fingerprints
# 256 SHA256:rhvbJ84cPXXezaoJiY7tFsG8CJxI2F/lLKz8q+xUW+g root@rescue (ED25519)
# 3072 SHA256:KBVMQLNWaDpzlCZERN9OeEDFAhUoADOZRfenXWHxswU root@rescue (RSA)
# publicKey = "";
#};
"robi" = { "robi" = {
hostNames = [ hostNames = [
"robi.private" "robi.private"
@ -34,8 +44,7 @@
config.module.cluster.services.tinc.private.hosts.sputnik.tincIp config.module.cluster.services.tinc.private.hosts.sputnik.tincIp
config.module.cluster.services.tinc.secret.hosts.sputnik.tincIp config.module.cluster.services.tinc.secret.hosts.sputnik.tincIp
]; ];
publicKey = publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTLXDTqUtl0BQgzH1O7CRulGCRN1P4KU8imL/wjYFh8";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTLXDTqUtl0BQgzH1O7CRulGCRN1P4KU8imL/wjYFh8";
}; };
"workhorse.private" = { "workhorse.private" = {
hostNames = [ hostNames = [
@ -44,16 +53,14 @@
config.module.cluster.services.tinc.private.hosts.workhorse.tincIp config.module.cluster.services.tinc.private.hosts.workhorse.tincIp
config.module.cluster.services.tinc.secret.hosts.workhorse.tincIp config.module.cluster.services.tinc.secret.hosts.workhorse.tincIp
]; ];
publicKey = publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDaK0Vv33TuGQa/B5p54sGilgpYvfKkBaBGlEBpIk1QB";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDaK0Vv33TuGQa/B5p54sGilgpYvfKkBaBGlEBpIk1QB";
}; };
"porani.secret" = { "porani.secret" = {
hostNames = [ hostNames = [
"porani.secret" "porani.secret"
config.module.cluster.services.tinc.secret.hosts.porani.tincIp config.module.cluster.services.tinc.secret.hosts.porani.tincIp
]; ];
publicKey = publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKNtRWVrqADgAMtTSWgnpp8gRKUtn4QUMFzQ78fC+aK";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKNtRWVrqADgAMtTSWgnpp8gRKUtn4QUMFzQ78fC+aK";
}; };
"pepe.private" = { "pepe.private" = {
hostNames = [ hostNames = [
@ -61,16 +68,14 @@
"pepe.lan" "pepe.lan"
config.module.cluster.services.tinc.private.hosts.pepe.tincIp config.module.cluster.services.tinc.private.hosts.pepe.tincIp
]; ];
publicKey = publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz";
}; };
"mobi.private" = { "mobi.private" = {
hostNames = [ hostNames = [
"mobi.private" "mobi.private"
config.module.cluster.services.tinc.private.hosts.mobi.tincIp config.module.cluster.services.tinc.private.hosts.mobi.tincIp
]; ];
publicKey = publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhBtcipW9rV6hHS2hv5tl5hd8vW8dnuFfFwnAs2u0kS";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhBtcipW9rV6hHS2hv5tl5hd8vW8dnuFfFwnAs2u0kS";
}; };
}; };
} }

2
nixos/system/server/initssh.nix
View file

@ -34,7 +34,7 @@ in
config.users.users.root.openssh.authorizedKeys.keyFiles); config.users.users.root.openssh.authorizedKeys.keyFiles);
}; };
hostKey = mkOption { hostKey = mkOption {
default = "/etc/ssh/ssh_host_ed25519_key"; default = "/etc/secrets/initrd/ssh_host_ed25519_key";
type = with types; path; type = with types; path;
description = '' description = ''
To generate keys, use ssh-keygen(1): To generate keys, use ssh-keygen(1):