mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
7cfda39c2c
The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo. Risks to weigh: - Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first. - Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch. ### Verification - `just test` exits 0; CI passed on the first commit. - Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`. - Not yet verified on a running host. ### Manual step after merge Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH. AI assistance: DeepSeek Harness (claude-opus-5-5). Assisted-by: DeepSeek Harness (claude-opus-5-5)
21 lines
559 B
Nix
21 lines
559 B
Nix
{
|
|
lib,
|
|
pkgs,
|
|
myvars,
|
|
...
|
|
}:
|
|
{
|
|
# sudo over SSH accepts a CanoKey touch through the forwarded agent; without
|
|
# it, sudo asks for the password as before. Only the hardware-backed keys are
|
|
# trusted, so a file key loaded in the agent cannot sign for sudo silently.
|
|
# Setup and limits: docs/security-keys.md.
|
|
security.pam.rssh = {
|
|
enable = true;
|
|
settings = {
|
|
auth_key_file = "${pkgs.writeText "sudo-ssh-agent-keys" (lib.concatLines myvars.canokeySshKeys)}";
|
|
cue = true;
|
|
};
|
|
};
|
|
security.pam.services.sudo.rssh = true;
|
|
}
|