BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #253147 from SuperSandro2000/ssh-forwardx11

Browse source 
nixos/ssh: add variant to not set ForwardX11
This commit is contained in:
Peder Bergebakken Sundt 2023-12-20 12:42:47 +01:00 committed by GitHub
commit 6b25f0686e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
nixos/modules/programs/ssh.nix
View file

@ -8,14 +8,12 @@ let
cfg = config.programs.ssh;
askPassword = cfg.askPassword;
askPasswordWrapper = pkgs.writeScript "ssh-askpass-wrapper"
''
#! ${pkgs.runtimeShell} -e
export DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^DISPLAY=\(.*\)/\1/; t; d')"
export WAYLAND_DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^WAYLAND_DISPLAY=\(.*\)/\1/; t; d')"
exec ${askPassword} "$@"
exec ${cfg.askPassword} "$@"
'';
knownHosts = attrValues cfg.knownHosts;
@ -52,10 +50,11 @@ in
};
forwardX11 = mkOption {
type = types.bool;
type = with lib.types; nullOr bool;
default = false;
description = lib.mdDoc ''
Whether to request X11 forwarding on outgoing connections by default.
If set to null, the option is not set at all.
This is useful for running graphical programs on the remote machine and have them display to your local X11 server.
Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two.
Note: there are some security risks to forwarding an X11 connection.
@ -274,10 +273,10 @@ in
config = {
programs.ssh.setXAuthLocation =
mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 || config.services.openssh.settings.X11Forwarding);
mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 == true || config.services.openssh.settings.X11Forwarding);
assertions =
[ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
[ { assertion = cfg.forwardX11 == true -> cfg.setXAuthLocation;
message = "cannot enable X11 forwarding without setting XAuth location";
}
] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
@ -298,11 +297,8 @@ in
AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}
${optionalString cfg.setXAuthLocation ''
XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
''}
ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}
${optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}
${lib.optionalString (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"}
${optionalString (cfg.pubkeyAcceptedKeyTypes != []) "PubkeyAcceptedKeyTypes ${concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}
${optionalString (cfg.hostKeyAlgorithms != []) "HostKeyAlgorithms ${concatStringsSep "," cfg.hostKeyAlgorithms}"}
@ -344,7 +340,7 @@ in
fi
'';
environment.variables.SSH_ASKPASS = optionalString cfg.enableAskPassword askPassword;
environment.variables.SSH_ASKPASS = optionalString cfg.enableAskPassword cfg.askPassword;
};
}