SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh-generator: Make sure sshd can always read the authorized keys file

Browse Source 
sshd reads AuthorizedKeysFile after dropping to the authenticating user's UID, so the
0400 credential file under %d/ is unreadable for non-root users. Materialize a 0444
copy in a RuntimeDirectory so the ephemeral key works for any user. */
This commit is contained in:
Daan De Meyer
2026-05-29 16:12:45 +02:00
committed by Daan De Meyer
parent 20572a8938
commit 0a63318420
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ssh-generator/ssh-generator.c
+7 -2
View File
@@ -109,15 +109,20 @@ static int make_sshd_template_unit(
if (r < 0)
return r;
/* sshd reads AuthorizedKeysFile after dropping to the authenticating user's UID, so the
* 0400 credential file under $CREDENTIALS_DIRECTORY is unreadable for non-root users.
* Materialize a 0444 copy in a RuntimeDirectory so the ephemeral key works for any user. */
fprintf(f,
"[Unit]\n"
"Description=OpenSSH Per-Connection Server Daemon\n"
"Documentation=man:systemd-ssh-generator(8) man:sshd(8)\n"
"\n"
"[Service]\n"
"ExecStart=-%s -i -o \"AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys\"\n"
"ExecStartPre=systemd-tmpfiles --create --inline 'f^ /run/sshd-generated-%%i/authorized_keys 0444 root root - ssh.ephemeral-authorized_keys-all'\n"
"ExecStart=-%s -i -o \"AuthorizedKeysFile /run/sshd-generated-%%i/authorized_keys .ssh/authorized_keys\"\n"
"StandardInput=socket\n"
"ImportCredential=ssh.ephemeral-authorized_keys-all\n",
"ImportCredential=ssh.ephemeral-authorized_keys-all\n"
"RuntimeDirectory=sshd-generated-%%i\n",
sshd_binary);
r = fflush_and_check(f);
src/vmspawn/vmspawn.c
+7 -2
View File
@@ -3506,13 +3506,18 @@ static int run_virtual_machine(int kvm_device_fd, int vhost_device_fd) {
/* on distros that provide their own sshd@.service file we need to provide a dropin which
* picks up our public key credential */
/* sshd reads AuthorizedKeysFile after dropping to the authenticating user's UID, so the
* 0400 credential file under %d/ is unreadable for non-root users. Materialize a 0444
* copy in a RuntimeDirectory so the ephemeral key works for any user. */
r = machine_credential_add(
&arg_credentials,
"systemd.unit-dropin.sshd-vsock@.service",
"[Service]\n"
"ExecStartPre=systemd-tmpfiles --create --inline 'f^ /run/sshd-vsock-%i/authorized_keys 0444 root root - ssh.ephemeral-authorized_keys-all'\n"
"ExecStart=\n"
"ExecStart=-sshd -i -o 'AuthorizedKeysFile=%d/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys'\n"
"ImportCredential=ssh.ephemeral-authorized_keys-all\n",
"ExecStart=-sshd -i -o 'AuthorizedKeysFile=/run/sshd-vsock-%i/authorized_keys .ssh/authorized_keys'\n"
"ImportCredential=ssh.ephemeral-authorized_keys-all\n"
"RuntimeDirectory=sshd-vsock-%i\n",
SIZE_MAX);
if (r < 0)
return log_error_errno(r, "Failed to set credential systemd.unit-dropin.sshd-vsock@.service: %m");