nixpkgs/nixos/modules/profiles
Jörg Thalheim a5872edf2f
nixos/installer: enable sshd by default
Right now the UX for installing NixOS on a headless system is very bad.
To enable sshd without physical steps users have to have either physical
access or need to be very knowledge-able to figure out how to modify the
installation image by hand to put an `sshd.service` symlink in the
right directory in /nix/store. This is in particular a problem on ARM
SBCs (single board computer) but also other hardware where network is
the only meaningful way to access the hardware.

This commit enables sshd by default. This does not give anyone access to
the NixOS installer since by default. There is no user with a non-empty
password or key. It makes it easy however to add ssh keys to the
installation image (usb stick, sd-card on arm boards) by simply mounting
it and adding a keys to `/root/.ssh/authorized_keys`.
Importantly this should not require nix/nixos on the machine that
prepare the installation device and even feasiable on non-linux systems
by using ext4 third party drivers.

Potential new threats: Since this enables sshd by default a
potential bug in openssh could lead to remote code execution. Openssh
has a very good track-record over the last 20 years, which makes it
far more likely that Linux itself would have a remote code execution
vulnerability. It is trusted by millions of servers on many operating
systems to be exposed to the internet by default.

Co-authored-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
2020-09-06 20:26:08 +02:00
..
all-hardware.nix usb-storage -> uas 2018-08-23 01:42:34 +00:00
base.nix nixos/systemPackages: clean up (#91213) 2020-08-20 13:45:54 +00:00
clone-config.nix ova: add cloneConfigExtra option 2018-10-21 14:52:49 -05:00
demo.nix nixos/displayManager: make autoLogin options independent of DM type 2020-07-09 21:15:35 -04:00
docker-container.nix docker-container: Remove /etc symlink 2019-11-27 15:51:19 -06:00
graphical.nix nixos/plasma5: drop enableQt4Support option 2019-11-22 09:01:05 +01:00
hardened.nix nixos/security/misc: add option unprivilegedUsernsClone 2020-08-25 14:18:24 +03:00
headless.nix modules/profiles/minimal: sound is disabled by default 2019-01-13 13:47:36 +01:00
installation-device.nix nixos/installer: enable sshd by default 2020-09-06 20:26:08 +02:00
minimal.nix types.optionSet: deprecate and remove last usages 2019-01-31 00:41:10 +02:00
qemu-guest.nix qemu-guest: allow to override security.rngd 2019-09-18 00:35:04 +09:00