mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
7cfda39c2c
The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo. Risks to weigh: - Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first. - Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch. ### Verification - `just test` exits 0; CI passed on the first commit. - Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`. - Not yet verified on a running host. ### Manual step after merge Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH. AI assistance: DeepSeek Harness (claude-opus-5-5). Assisted-by: DeepSeek Harness (claude-opus-5-5)
63 lines
3.1 KiB
Nix
63 lines
3.1 KiB
Nix
{ lib }:
|
|
let
|
|
# CanoKey resident SSH keys: they log in like the main keys, and they are the
|
|
# only keys pam_rssh accepts for sudo on servers through the forwarded agent
|
|
# (modules/nixos/server/ssh-agent-sudo.nix).
|
|
canokeySshKeys = [
|
|
# CanoKey Canary (backup)
|
|
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgfNy/wJgTw6auO4RmRHR9kh1Mt5TYNkomMDFLJ4Kw6AAAADHNzaDpyeWFuNHlpbg== ryan@canokey-moe"
|
|
];
|
|
in
|
|
{
|
|
inherit canokeySshKeys;
|
|
username = "ryan";
|
|
userfullname = "Ryan Yin";
|
|
useremail = "xiaoyin_c@qq.com";
|
|
networking = import ./networking.nix { inherit lib; };
|
|
ports = import ./ports.nix;
|
|
# Generated using: mkpasswd -m yescrypt --rounds=11
|
|
# Password: long, strong random string (full charset)
|
|
# Rotation policy: changed annually
|
|
# Purpose: system login password only
|
|
# https://man.archlinux.org/man/crypt.5.en
|
|
initialHashedPassword = "$y$jFT$RBapCH3F6bc0uSF.FaUGB.$rvhiVvcCKxkkumDFLONV5zFP1lsv1VyZ1ErH.r2rNk3";
|
|
# Public Keys that can be used to login to all my PCs, Macbooks, and servers.
|
|
#
|
|
# Since its authority is so large, we must strengthen its security:
|
|
# 1. The corresponding private key must be:
|
|
# 1. Generated locally on every trusted client via:
|
|
# ```bash
|
|
# # KDF: bcrypt with 256 rounds, takes 2s on Apple M2):
|
|
# # Passphrase: digits + letters + symbols, 12+ chars
|
|
# ssh-keygen -t ed25519 -a 256 -C "ryan@xxx" -f ~/.ssh/xxx
|
|
# ```
|
|
# 2. Never leave the device and never sent over the network.
|
|
# 2. Or just use hardware security keys like Yubikey/CanoKey.
|
|
mainSshAuthorizedKeys = [
|
|
# The main ssh keys for daily usage
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKlN+Q/GxvwxDX/OAjJHaNFEznEN4Tw4E4TwqQu/eD6 ryan@idols-ai"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwoI5MAogEa726jwwHL5EgM1X/i2A5d2pgV7i7t8fzB ryan@shoukei"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDc1PNTXzzvd93E+e9LXvnEzqgUI5gMTEF/IitvzgmL+ ryan@frieren"
|
|
]
|
|
++ canokeySshKeys;
|
|
# CanoKey U2F registrations for sudo (modules/nixos/desktop/canokey.nix).
|
|
# Key handles and public keys only, so they are safe to commit.
|
|
canokeyU2fKeys = [
|
|
# CanoKey Canary (backup)
|
|
"DwXDxVU+NDTUZs/d2EjpsPAh4mrg7dqdg/mAozkw/mUAAdEYDZIbm8kTBUGA49wXW0ZvSpF9VNYh2w84Xz9nAIAW////+Q==,6hqEjWBJ+ueBKBJaNijNkUsmlgEHMgv0KdpprqdJjHKoU/FKpeqo12SWlvdgiIVWvqTaGfe4fNu/ckcGY5mlsA==,es256,+presence"
|
|
];
|
|
secondaryAuthorizedKeys = [
|
|
# the backup ssh keys for disaster recovery
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMzYT0Fpcp681eHY5FJV2G8Mve53iX3hMOLGbVvfL+TF ryan@romantic"
|
|
];
|
|
# The SSH host keys of the machines whose nix-daemons build through aquamarine
|
|
# (modules/nixos/base/remote-builders.nix).
|
|
remoteBuilderClientKeys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINHZtzeaQyXwuRMLzoOAuTu8P9bu5yc5MBwo5LI3iWBV root@ai"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILDkbOwOeuAem8BKbyTDliRiTfHVAFdiVpAKh1bhs2s0 root@shoukei"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGSSw4Oa8CaAeYXq2+O/SHHICaoUTFTGYjW5R9MzZ9Nj root@shoryu"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK4Po3tzTPVKEE5fAk4RQfhTvA4h+AurnkEiM7RYdND9 root@shushou"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEs8b3CmxM+utXZVKvJBssXBupBXvvzjHP40HcY7PSyZ root@youko"
|
|
];
|
|
}
|