diff options
Diffstat (limited to 'gnu/services/ssh.scm')
| -rw-r--r-- | gnu/services/ssh.scm | 133 |
1 files changed, 132 insertions, 1 deletions
diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index 9a7ea0fb46..084f8fa4ea 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -1,6 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org> ;;; Copyright © 2016 David Craven <david@craven.ch> +;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu> ;;; ;;; This file is part of GNU Guix. ;;; @@ -19,17 +20,25 @@ (define-module (gnu services ssh) #:use-module (gnu packages ssh) + #:use-module (gnu packages admin) #:use-module (gnu services) #:use-module (gnu services shepherd) #:use-module (gnu system pam) + #:use-module (gnu system shadow) #:use-module (guix gexp) #:use-module (guix records) #:use-module (srfi srfi-26) + #:use-module (ice-9 match) #:export (lsh-configuration lsh-configuration? lsh-service lsh-service-type + openssh-configuration + openssh-configuration? + openssh-service-type + openssh-service + dropbear-configuration dropbear-configuration? dropbear-service-type @@ -122,7 +131,7 @@ (define lsh-command (append - (cons #~(string-append #$lsh "/sbin/lshd") + (cons (file-append lsh "/sbin/lshd") (if daemonic? (let ((syslog (if (lsh-configuration-syslog-output? config) '() @@ -246,6 +255,128 @@ The other options should be self-descriptive." ;;; +;;; OpenSSH. +;;; + +(define-record-type* <openssh-configuration> + openssh-configuration make-openssh-configuration + openssh-configuration? + (pid-file openssh-configuration-pid-file) ;string + (port-number openssh-configuration-port-number) ;integer + (permit-root-login openssh-configuration-permit-root-login) ;Boolean | 'without-password + (allow-empty-passwords? openssh-configuration-allow-empty-passwords?) ;Boolean + (password-authentication? openssh-configuration-password-authentication?) ;Boolean + (pubkey-authentication? openssh-configuration-pubkey-authentication?) ;Boolean + (rsa-authentication? openssh-configuration-rsa-authentication?) ;Boolean + (x11-forwarding? openssh-configuration-x11-forwarding?) ;Boolean + (protocol-number openssh-configuration-protocol-number)) ;integer + +(define %openssh-accounts + (list (user-group (name "sshd") (system? #t)) + (user-account + (name "sshd") + (group "sshd") + (system? #t) + (comment "sshd privilege separation user") + (home-directory "/var/run/sshd") + (shell #~(string-append #$shadow "/sbin/nologin"))))) + +(define (openssh-activation config) + "Return the activation GEXP for CONFIG." + #~(begin + (mkdir-p "/etc/ssh") + (mkdir-p (dirname #$(openssh-configuration-pid-file config))) + + ;; Generate missing host keys. + (system* (string-append #$openssh "/bin/ssh-keygen") "-A"))) + +(define (openssh-config-file config) + "Return the sshd configuration file corresponding to CONFIG." + (computed-file + "sshd_config" + #~(call-with-output-file #$output + (lambda (port) + (display "# Generated by 'openssh-service'.\n" port) + (format port "Protocol ~a\n" + #$(if (eq? (openssh-configuration-protocol-number config) 1) + "1" "2")) + (format port "Port ~a\n" + #$(number->string (openssh-configuration-port-number config))) + (format port "PermitRootLogin ~a\n" + #$(match (openssh-configuration-permit-root-login config) + (#t "yes") + (#f "no") + ('without-password "without-password"))) + (format port "PermitEmptyPasswords ~a\n" + #$(if (openssh-configuration-allow-empty-passwords? config) + "yes" "no")) + (format port "PasswordAuthentication ~a\n" + #$(if (openssh-configuration-password-authentication? config) + "yes" "no")) + (format port "PubkeyAuthentication ~a\n" + #$(if (openssh-configuration-pubkey-authentication? config) + "yes" "no")) + (format port "RSAAuthentication ~a\n" + #$(if (openssh-configuration-rsa-authentication? config) + "yes" "no")) + (format port "X11Forwarding ~a\n" + #$(if (openssh-configuration-x11-forwarding? config) + "yes" "no")) + (format port "PidFile ~a\n" + #$(openssh-configuration-pid-file config)) + #t)))) + +(define (openssh-shepherd-service config) + "Return a <shepherd-service> for openssh with CONFIG." + + (define pid-file + (openssh-configuration-pid-file config)) + + (define openssh-command + #~(list (string-append #$openssh "/sbin/sshd") + "-D" "-f" #$(openssh-config-file config))) + + (list (shepherd-service + (documentation "OpenSSH server.") + (requirement '(networking syslogd)) + (provision '(ssh-daemon)) + (start #~(make-forkexec-constructor #$openssh-command + #:pid-file #$pid-file)) + (stop #~(make-kill-destructor))))) + +(define openssh-service-type + (service-type (name 'openssh) + (extensions + (list (service-extension shepherd-root-service-type + openssh-shepherd-service) + (service-extension activation-service-type + openssh-activation) + (service-extension account-service-type + (const %openssh-accounts)))))) + +(define* (openssh-service #:key + (pid-file "/var/run/sshd.pid") + (port-number 22) + (permit-root-login 'without-password) + (allow-empty-passwords? #f) + (password-authentication? #t) + (pubkey-authentication? #t) + (rsa-authentication? #t) + (x11-forwarding? #f) + (protocol-number 2)) + (service openssh-service-type (openssh-configuration + (pid-file pid-file) + (port-number port-number) + (permit-root-login permit-root-login) + (allow-empty-passwords? allow-empty-passwords?) + (password-authentication? password-authentication?) + (pubkey-authentication? pubkey-authentication?) + (rsa-authentication? rsa-authentication?) + (x11-forwarding? x11-forwarding?) + (protocol-number protocol-number)))) + + +;;; ;;; Dropbear. ;;; |