iot/ostree
0
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: restore SSH key management for Ignition #98

Merged
pwhalen merged 1 commit from ssh-key-fix into main 2026-02-24 20:41:16 +00:00
Conversation 6 Commits 1 Files changed 2 +24 -1
pwhalen commented 2026-02-24 20:33:46 +00:00
Owner
Copy link

Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in
addition to authorized_keys, restoring functionality lost when
ssh-key-dir was removed.

Follows the same approach as CoreOS:
https://github.com/coreos/fedora-coreos-config/pull/3885

Signed-off-by: Paul Whalen pwhalen@fedoraproject.org

Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>
pwhalen commented 2026-02-24 20:37:21 +00:00
Author
Owner
Copy link

rebased onto 240bff70e7

rebased onto 240bff70e742b6916271144f9d61ca79bc98f24b
pbrobinson commented 2026-02-24 20:40:35 +00:00
Owner
Copy link

This is overall fine to fix the problem, i think the files/dirs we're creating here should be part of a package

This is overall fine to fix the problem, i think the files/dirs we're creating here should be part of a package
pbrobinson commented 2026-02-24 20:41:16 +00:00
Owner
Copy link

Pull-Request has been merged by pbrobinson

Pull-Request has been merged by pbrobinson
pbrobinson commented 2026-02-24 20:46:48 +00:00
Owner
Copy link

so /etc/ssh/sshd_config.d belongs to openssh-server and systemd so we should never have to create it

so /etc/ssh/sshd_config.d belongs to openssh-server and systemd so we should never have to create it
pbrobinson commented 2026-02-24 20:54:30 +00:00
Owner
Copy link

And as 40-authorized-keys-file.conf is basically a static config file it should likely be part of the ignition and/or afterburn package so it can be properly managed.

Also I question the 40- runtime number as we have the following:
40-redhat-crypto-policies.conf
50-redhat.conf

I think the -authorized-keys-file.conf should be 60+ in numbering so the crypto policies and redhat (which specifies things like PAM/GSSAPI configs) are executed before this one and hence ensure the keys get all the previous policies applied.

I would actually name this 90 as it's basically sourcing user keys and everything else should be enforced first.

And as 40-authorized-keys-file.conf is basically a static config file it should likely be part of the ignition and/or afterburn package so it can be properly managed. Also I question the 40- runtime number as we have the following: 40-redhat-crypto-policies.conf 50-redhat.conf I think the -authorized-keys-file.conf should be 60+ in numbering so the crypto policies and redhat (which specifies things like PAM/GSSAPI configs) are executed before this one and hence ensure the keys get all the previous policies applied. I would actually name this 90 as it's basically sourcing user keys and everything else should be enforced first.
jcapitao commented 2026-02-25 10:18:19 +00:00
Contributor
Copy link

FYI I proposed https://src.fedoraproject.org/rpms/ignition/pull-request/143 to handle this

FYI I proposed https://src.fedoraproject.org/rpms/ignition/pull-request/143 to handle this
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
iot/ostree!98
No description provided.