nixpkgs/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub at f886334c9d32e051261c84f9b35e6317898d48cb - MirrorHub/nixpkgs - tilera Git

MirrorHub/nixpkgs

mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-15 22:36:23 +01:00

Emily d930466b77 nixos/initrd-ssh: switch from Dropbear to OpenSSH

Dropbear lags behind OpenSSH significantly in both support for modern
key formats like `ssh-ed25519`, let alone the recently-introduced
U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched
my `authorizedKeys` over to it and promptly locked myself out of my
server's initrd SSH, breaking reboots), as well as security features
like multiprocess isolation. Using the same SSH daemon for stage-1 and
the main system ensures key formats will always remain compatible, as
well as more conveniently allowing the sharing of configuration and
host keys.

The main reason to use Dropbear over OpenSSH would be initrd space
concerns, but NixOS initrds are already large (17 MiB currently on my
server), and the size difference between the two isn't huge (the test's
initrd goes from 9.7 MiB to 12 MiB with this change). If the size is
still a problem, then it would be easy to shrink sshd down to a few
hundred kilobytes by using an initrd-specific build that uses musl and
disables things like Kerberos support.

This passes the test and works on my server, but more rigorous testing
and review from people who use initrd SSH would be appreciated!

2020-03-25 08:26:50 +00:00

1 line

98 B

Text

Raw Blame History

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost