nixpkgs/nixos/modules
Maximilian Bosch 00a5222499
nixos/sshd: validate ssh configs during build
With `sshd -t` config validation for SSH is possible. Until now, the
config generated by Nix was applied without any validation (which is
especially a problem for advanced config like `Match` blocks).

When deploying broken ssh config with nixops to a remote machine it gets
even harder to fix the problem due to the broken ssh that makes reverts
with nixops impossible.

This change performs the validation in a Nix build environment by
creating a store path with the config and generating a mocked host key
which seems to be needed for the validation. With a broken config, the
deployment already fails during the build of the derivation.

The original attempt was done in #56345 by adding a submodule for Match
groups to make it harder screwing that up, however that made the module
far more complex and config should be described in an easier way as
described in NixOS/rfcs#42.
2019-05-24 20:16:53 +02:00
..
config nixos/ldap: set proper User= and Group= for nslcd service 2019-03-28 13:08:47 +01:00
hardware nixos/docker: add enableNvidia option 2019-02-27 09:56:03 +01:00
i18n/input-method docs: format 2018-09-29 20:51:11 -04:00
installer Revert "Merge pull request #57559 from Ekleog/iso-image-reproducibilization" 2019-04-01 18:17:42 +02:00
misc nixos: doc: optionally include all modules in manual generation 2019-03-05 09:41:40 +00:00
profiles profiles/graphical.nix: Enable pulseaudio for virtualbox appliances 2019-02-22 07:23:59 +01:00
programs nixos/browserpass: update for v3 2019-04-01 01:24:54 +02:00
security yubico-pam: add nixos integration 2019-03-31 12:04:35 -05:00
services nixos/sshd: validate ssh configs during build 2019-05-24 20:16:53 +02:00
system Merge pull request #57519 (systemd-confinement) 2019-03-29 04:37:53 +01:00
tasks filesystems: Add autoResize assertion 2019-03-16 13:01:35 +01:00
testing types.optionSet: deprecate and remove last usages 2019-01-31 00:41:10 +02:00
virtualisation nixos: Don't enable Docker by default 2019-03-26 07:10:18 +01:00
module-list.nix Merge pull request #57519 (systemd-confinement) 2019-03-29 04:37:53 +01:00
rename.nix nixos/rename: drop system.nixos.{stateVersion, defaultChannel} 2019-03-30 18:18:39 -04:00