Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: 42d03aabbd34
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: 5626cb948673
Choose a head ref
  • 2 commits
  • 13 files changed
  • 2 contributors

Commits on Mar 25, 2020

  1. nixos/initrd-ssh: switch from Dropbear to OpenSSH

    Dropbear lags behind OpenSSH significantly in both support for modern
    key formats like `ssh-ed25519`, let alone the recently-introduced
    U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched
    my `authorizedKeys` over to it and promptly locked myself out of my
    server's initrd SSH, breaking reboots), as well as security features
    like multiprocess isolation. Using the same SSH daemon for stage-1 and
    the main system ensures key formats will always remain compatible, as
    well as more conveniently allowing the sharing of configuration and
    host keys.
    
    The main reason to use Dropbear over OpenSSH would be initrd space
    concerns, but NixOS initrds are already large (17 MiB currently on my
    server), and the size difference between the two isn't huge (the test's
    initrd goes from 9.7 MiB to 12 MiB with this change). If the size is
    still a problem, then it would be easy to shrink sshd down to a few
    hundred kilobytes by using an initrd-specific build that uses musl and
    disables things like Kerberos support.
    
    This passes the test and works on my server, but more rigorous testing
    and review from people who use initrd SSH would be appreciated!
    emilazy committed Mar 25, 2020
    Copy the full SHA
    d930466 View commit details
    Browse the repository at this point in the history

Commits on Mar 28, 2020

  1. Merge pull request #82603 from emilazy/nixos-initrd-openssh

    nixos/initrd-ssh: switch from Dropbear to OpenSSH
    lukateras committed Mar 28, 2020
    Copy the full SHA
    5626cb9 View commit details
    Browse the repository at this point in the history