Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix ssh config in nova image #30182

Closed
wants to merge 1 commit into from
Closed

Fix ssh config in nova image #30182

wants to merge 1 commit into from

Conversation

nlewo
Copy link
Member

@nlewo nlewo commented Oct 7, 2017

Motivation for this change

Fix the build of the nova image

Things done

Build the image

  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • Linux
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@Mic92
Copy link
Member

Mic92 commented Oct 7, 2017

Do we really want to allow root login with password by default? Is it not encouraged by openstack to deploy ssh keys to the vm image by cloud-init? I mean, if somebody really wants to use a password instead it always possible to create a custom nova-image with this setting enabled.

@nlewo
Copy link
Member Author

nlewo commented Oct 7, 2017

@Mic92 except if I misunderstood something, with this commit, the ssh root authentication is only allowed with a key. So, it seems this is what you're wanting.

Mic92
Mic92 reviewed Oct 7, 2017
View reviewed changes
nixos/modules/virtualisation/nova-config.nix
@@ -24,7 +24,7 @@ with lib;
# Allow root logins
services.openssh = {
enable = true;
permitRootLogin = "prohibit-password";
permitRootLogin = "without-password";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I remember. prohibit-password was introduced later in sshd as an less ambitious alias for without-password.
So both options have the same effect.

@nlewo
Copy link
Member Author

nlewo commented Oct 7, 2017

@Mic92 arf, my bad. In fact this patch is not required. Sorry.
I was building the nova image with a wrong nixpkgs tree: a older one that didn't have the prohibit-password ssh option yet...

@nlewo nlewo closed this Oct 7, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mic92 Mic92 Mic92 left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@nlewo @Mic92