diff --git a/modules/features/ssh-certs.nix b/modules/features/ssh-certs.nix index f1a8ea2..462d414 100644 --- a/modules/features/ssh-certs.nix +++ b/modules/features/ssh-certs.nix @@ -128,6 +128,9 @@ in type = lib.types.nullOr lib.types.str; default = "admin"; }; + provisionerPasswordFile = lib.mkOption { + type = lib.types.nullOr lib.types.str; + }; validUsers = lib.mkOption { description = "A list of the user names that this cert will be valid for"; type = lib.types.listOf lib.types.str; @@ -141,6 +144,9 @@ in package = config.pkgs.step-cli; args = [ "ssh" "certificate" "--sign" ] ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ] + ++ lib.optionals (config.provisionerPasswordFile != null) [ + "--provisioner-password-file" "${config.provisionerPasswordFile}" + ] ++ lib.optionals config.overwrite [ "-f" ] ++ mkPrincipalArgs config.validUsers; }; diff --git a/modules/features/ssh.nix b/modules/features/ssh.nix new file mode 100644 index 0000000..a4f4d7e --- /dev/null +++ b/modules/features/ssh.nix @@ -0,0 +1,263 @@ +# New attempt at consolidating SSH config that wraps the step client, SSH certs, and all that in a top-level module +{ self, inputs, ... }: +let + caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ]; +in +{ + flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }: + let + cfg = config.ssh-new; + hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}"; + hostCertFile = "${hostKeyFile}-cert.pub"; + userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}"; + sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub); + CAknownHosts = (lib.genAttrs caPatterns (_: { + certAuthority = true; + publicKey = sshHostCAContent; + })); + + wrappers = inputs.self.wrappers; + provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path; + sshHostCertSign = (wrappers.signHostWrapper.apply { + inherit pkgs provisionerPasswordFile; + inherit (cfg.certificates) provisioner; + inherit (cfg.certificates.host) extraPrincipals; + }).wrapper; + sshHostCertRenew = (wrappers.renewHostWrapper.apply { + inherit pkgs; + sshHostKeyFile = hostKeyFile; + overwrite = true; + }).wrapper; + sshHostCertCheck = (wrappers.hostCheckWrapper.apply { + inherit pkgs; + certPath = hostCertFile; + }).wrapper; + sshHostRenewalCheck = (wrappers.renewalCheck.apply { + inherit pkgs; + certPath = hostCertFile; + expires-in = "4h"; + }).wrapper; + sshUserCertSign = (wrappers.signUserWrapper.apply { + inherit pkgs provisionerPasswordFile; + inherit (cfg.certificates) provisioner; + validUsers = [ "root" "john" "appdaemon" ]; + }).wrapper; + sshUserCertCheck = (wrappers.userCheckWrapper.apply { + inherit pkgs; + certPath = "${cfg.user.keyFile}-cert.pub"; + }).wrapper; + in + { + options.ssh-new = { + user = { + keyFile = lib.mkOption { + type = lib.types.str; + default = "$HOME/.ssh/id_ed25519"; + }; + }; + host = { + configDir = lib.mkOption { + type = lib.types.str; + default = "/etc/ssh"; + }; + keyFile = lib.mkOption { + description = "String path to the host private key file"; + type = lib.types.str; + default = "ssh_host_ed25519_key"; + }; + keyType = lib.mkOption { + description = "OpenSSH host key type for ssh.hostKey."; + type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ]; + default = "ed25519"; + }; + extraSettings = lib.mkOption { + description = "Extra settings to merge"; + type = lib.types.attrs; + default = { }; + }; + }; + certificates = { + provisioner = lib.mkOption { + type = lib.types.nullOr lib.types.str; + }; + host = { + enable = lib.mkEnableOption "Enable SSH host certs"; + autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer"; + extraPrincipals = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + }; + user = { + enable = lib.mkEnableOption "Enable SSH user certs"; + CAFile = lib.mkOption { + description = "Filename of the SSH user CA with the config directory"; + type = lib.types.str; + default = "ssh_user_ca_key.pub"; + }; + extraPrincipals = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + }; + }; + }; + + config = { + services.openssh = { + enable = true; + openFirewall = true; + hostKeys = [ + { + path = hostKeyFile; + type = cfg.host.keyType; + } + ]; + settings = lib.mkMerge [ + { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + } + cfg.host.extraSettings + (lib.mkIf cfg.certificates.host.enable { + HostCertificate = "${hostKeyFile}-cert.pub"; + }) + (lib.mkIf cfg.certificates.user.enable { + TrustedUserCAKeys = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}"; + }) + ]; + }; + + environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable { + source = ../hosts/janus/public/ssh_user_ca_key.pub; + }; + + environment.systemPackages = ( + lib.optionals cfg.certificates.host.enable [ + sshHostCertSign + sshHostCertRenew + sshHostRenewalCheck + sshHostCertCheck + ] + ); + + sops = lib.mkIf cfg.certificates.host.autoRenew { + secrets."janus/admin_jwk" = { + sopsFile = ../../keys/secrets.yaml; + owner = "root"; + group = "root"; + mode = "0400"; + }; + }; + + systemd = lib.mkIf cfg.certificates.host.autoRenew { + services.ssh-certs-renew = { + description = "SSH host certificate renewal"; + wantedBy = [ "multi-user.target" ]; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + path = with pkgs; [ step-cli systemd ]; + serviceConfig = { + Type = "oneshot"; + User = "root"; + Group = "root"; + ExecCondition = lib.getExe sshHostRenewalCheck; + ExecStart = lib.getExe sshHostCertRenew; + }; + }; + timers.ssh-certs-renew = { + description = "Periodic Step SSH host certificate renewal"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "5m"; + OnUnitActiveSec = "4h"; + RandomizedDelaySec = "15m"; + Persistent = true; + Unit = "ssh-certs-renew.service"; + }; + }; + }; + + # This winds up in /etc/ssh/ssh_known_hosts, which applies to all users + programs.ssh.knownHosts = lib.mkIf cfg.certificates.user.enable CAknownHosts; + + home-manager.users.root = lib.mkIf cfg.certificates.user.enable { + home.stateVersion = lib.mkDefault config.system.stateVersion; + imports = with inputs.self.modules.homeManager; [ + ssh-new + ]; + home.packages = [ + sshUserCertSign + sshUserCertCheck + ]; + ssh-new.certificates.enable = true; + }; + }; + }; + + flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }: + let + cfg = config.ssh-new; + sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub); + knownHostsText = lib.concatMapStrings + (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n") + caPatterns; + in + { + options.ssh-new = { + keyFile = lib.mkOption { + type = lib.types.str; + default = "${config.home.homeDirectory}/.ssh/id_ed25519"; + }; + certificates = { + enable = lib.mkEnableOption "Enable SSH client certificates"; + }; + }; + + config = { + home.file = lib.mkIf cfg.certificates.enable { + ".ssh/known_hosts".text = knownHostsText; + }; + programs.ssh = { + enable = true; + enableDefaultConfig = false; + settings = { + # These settings apply to all connections + "*" = lib.mkMerge ( + [ + # Default settings + { + Compression = false; + ServerAliveInterval = 60; + ServerAliveCountMax = 3; + TCPKeepAlive = "yes"; + + PubkeyAuthentication = "yes"; + PasswordAuthentication = "no"; + PreferredAuthentications = "publickey"; + IdentitiesOnly = true; + IdentityFile = cfg.keyFile; + + StrictHostKeyChecking = "accept-new"; + UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts"; + + HashKnownHosts = lib.mkDefault false; + AddKeysToAgent = lib.mkDefault "yes"; + ForwardAgent = lib.mkDefault false; + + RequestTTY = lib.mkDefault "auto"; + SetEnv.TERM = "xterm-256color"; + } + ] + # SSH certificate settings + ++ lib.optionals cfg.certificates.enable [ + { + CertificateFile = "${cfg.keyFile}-cert.pub"; + } + ] + ); + }; + }; + }; + }; +} \ No newline at end of file diff --git a/modules/hosts/janus/default.nix b/modules/hosts/janus/default.nix index c2b090f..6f4ebdd 100644 --- a/modules/hosts/janus/default.nix +++ b/modules/hosts/janus/default.nix @@ -4,13 +4,15 @@ let hostname = "janus"; ipv4 = "192.168.1.32"; ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57"; + names = [ "${hostname}.john-stream.com" ipv4 ipv6 ]; in { flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem { modules = with inputs.self.modules; [ nixos.lxc nixos.mysops - nixos.ssh-certs + # nixos.ssh-certs + nixos.ssh-new nixos.step-client nixos.step-ca inputs.home-manager.nixosModules.home-manager @@ -24,18 +26,19 @@ in "Step-CA" = "step-ca"; }; sops.defaultSopsFile = ./secrets.yaml; - ssh-certs = { + ssh-new.certificates = { provisioner = "admin"; - extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ]; + host = { + enable = true; + extraPrincipals = names; + autoRenew = true; + }; + user.enable = true; }; step-ca = { rootCertPath = ./public/root_ca.crt; intermediateCertPath = ./public/intermediate_ca.crt; - dnsNames = [ - "${hostname}.john-stream.com" - ipv4 - ipv6 - ]; + dnsNames = names; secrets = { sopsFile = ./secrets.yaml; caPassword = "janus/ca_password"; @@ -67,10 +70,6 @@ in ); }; - # users.users."${username}".openssh.authorizedKeys.keys = [ - # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus" - # ]; - home-manager.users."${username}" = { imports = with inputs.self.modules.homeManager; [ mysops diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix index 48dd144..b541590 100644 --- a/modules/nixos/lxc.nix +++ b/modules/nixos/lxc.nix @@ -15,12 +15,9 @@ nix.settings.experimental-features = [ "nix-command" "flakes" ]; environment.systemPackages = with pkgs; [ git - zsh selfPackages.jsl-zsh-tty ]; - environment.shells = lib.mkAfter [ - rootShellPath - ]; + environment.shells = lib.mkAfter [ rootShellPath ]; users.users.root.shell = lib.mkForce rootShellPath; # security.sudo-rs.enable = true;