mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2024-12-24 05:18:07 -05:00
services: openssh: Replace 'without-password' by 'prohibit-password'.
For some time, OpenSSH's option 'PermitRootLogin' has deprecated the ambiguous argument 'without-password' with 'prohibit-password'. * doc/guix.texi (Network Services): Replace 'without-password by 'prohibit-password. * gnu/machine/digital-ocean.scm (guix-infect): Change system configuration to use 'prohibit-password. * gnu/services/ssh.scm (openssh-configuration): Change comment to use 'prohibit-password. (openssh-config-file): Add support for 'prohibit-password to 'permit-root-login'. Warn about deprecated 'without-password usage. * gnu/tests/ganeti.scm (%ganeti-os): Replace 'without-password by 'prohibit-password. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
This commit is contained in:
parent
a211078f99
commit
ef3f38ea00
4 changed files with 16 additions and 7 deletions
|
@ -17070,7 +17070,7 @@ shell daemon, @command{sshd}. Its value must be an
|
|||
(service openssh-service-type
|
||||
(openssh-configuration
|
||||
(x11-forwarding? #t)
|
||||
(permit-root-login 'without-password)
|
||||
(permit-root-login 'prohibit-password)
|
||||
(authorized-keys
|
||||
`(("alice" ,(local-file "alice.pub"))
|
||||
("bob" ,(local-file "bob.pub"))))))
|
||||
|
@ -17104,7 +17104,7 @@ TCP port on which @command{sshd} listens for incoming connections.
|
|||
@item @code{permit-root-login} (default: @code{#f})
|
||||
This field determines whether and when to allow logins as root. If
|
||||
@code{#f}, root logins are disallowed; if @code{#t}, they are allowed.
|
||||
If it's the symbol @code{'without-password}, then root logins are
|
||||
If it's the symbol @code{'prohibit-password}, then root logins are
|
||||
permitted but not with password-based authentication.
|
||||
|
||||
@item @code{allow-empty-passwords?} (default: @code{#f})
|
||||
|
@ -29333,7 +29333,7 @@ cluster node that supports multiple storage backends, and installs the
|
|||
;; Ganeti uses SSH to communicate between nodes.
|
||||
(service openssh-service-type
|
||||
(openssh-configuration
|
||||
(permit-root-login 'without-password)))
|
||||
(permit-root-login 'prohibit-password)))
|
||||
|
||||
(service ganeti-service-type
|
||||
(ganeti-configuration
|
||||
|
|
|
@ -1,5 +1,6 @@
|
|||
;;; GNU Guix --- Functional package management for GNU
|
||||
;;; Copyright © 2019 Jakob L. Kreuze <zerodaysfordays@sdf.org>
|
||||
;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
@ -256,7 +257,7 @@ (define (guix-infect network)
|
|||
(service openssh-service-type
|
||||
(openssh-configuration
|
||||
(log-level 'debug)
|
||||
(permit-root-login 'without-password))))
|
||||
(permit-root-login 'prohibit-password))))
|
||||
%base-services)))
|
||||
EOF
|
||||
# guix pull
|
||||
|
|
|
@ -6,6 +6,8 @@
|
|||
;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
|
||||
;;; Copyright © 2020 pinoaffe <pinoaffe@airmail.cc>
|
||||
;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
|
||||
;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
|
||||
;;; Copyright © 2021 Tobias Geerinckx-Rice <me@tobias.gr>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
@ -30,6 +32,7 @@ (define-module (gnu services ssh)
|
|||
#:use-module (gnu services web)
|
||||
#:use-module (gnu system pam)
|
||||
#:use-module (gnu system shadow)
|
||||
#:use-module (guix deprecation)
|
||||
#:use-module (guix gexp)
|
||||
#:use-module (guix records)
|
||||
#:use-module (guix modules)
|
||||
|
@ -288,7 +291,7 @@ (define-record-type* <openssh-configuration>
|
|||
;; integer
|
||||
(port-number openssh-configuration-port-number
|
||||
(default 22))
|
||||
;; Boolean | 'without-password
|
||||
;; Boolean | 'prohibit-password
|
||||
(permit-root-login openssh-configuration-permit-root-login
|
||||
(default #f))
|
||||
;; Boolean
|
||||
|
@ -441,7 +444,11 @@ (define (openssh-config-file config)
|
|||
#$(match (openssh-configuration-permit-root-login config)
|
||||
(#t "yes")
|
||||
(#f "no")
|
||||
('without-password "without-password")))
|
||||
('without-password (warn-about-deprecation
|
||||
'without-password #f
|
||||
#:replacement 'prohibit-password)
|
||||
"prohibit-password")
|
||||
('prohibit-password "prohibit-password")))
|
||||
(format port "PermitEmptyPasswords ~a\n"
|
||||
#$(if (openssh-configuration-allow-empty-passwords? config)
|
||||
"yes" "no"))
|
||||
|
|
|
@ -1,5 +1,6 @@
|
|||
;;; GNU Guix --- Functional package management for GNU
|
||||
;;; Copyright © 2020 Marius Bakke <marius@gnu.org>.
|
||||
;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
@ -65,7 +66,7 @@ (define %ganeti-os
|
|||
|
||||
(service openssh-service-type
|
||||
(openssh-configuration
|
||||
(permit-root-login 'without-password)))
|
||||
(permit-root-login 'prohibit-password)))
|
||||
|
||||
(service ganeti-service-type
|
||||
(ganeti-configuration
|
||||
|
|
Loading…
Reference in a new issue