commit d930466b7728e5515991cb73c060fc3f32bdc001 · pyrox.dev/nixpkgs

+17

nixos/doc/manual/release-notes/rl-2009.xml

···

       108
       108
        
             <link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.

     

       109
       109
        
           </para>

     

       110
       110
        
          </listitem>

     

       111
       111
       +
          <listitem>

     

       112
       112
       +
           <para>

     

       113
       113
       +
            The initrd SSH support now uses OpenSSH rather than Dropbear to

     

       114
       114
       +
            allow the use of Ed25519 keys and other OpenSSH-specific

     

       115
       115
       +
            functionality. Host keys must now be in the OpenSSH format, and at

     

       116
       116
       +
            least one pre-generated key must be specified.

     

       117
       117
       +
           </para>

     

       118
       118
       +
           <para>

     

       119
       119
       +
            If you used the <option>boot.initrd.network.ssh.host*Key</option>

     

       120
       120
       +
            options, you'll get an error explaining how to convert your host

     

       121
       121
       +
            keys and migrate to the new

     

       122
       122
       +
            <option>boot.initrd.network.ssh.hostKeys</option> option.

     

       123
       123
       +
            Otherwise, if you don't have any host keys set, you'll need to

     

       124
       124
       +
            generate some; see the <option>hostKeys</option> option

     

       125
       125
       +
            documentation for instructions.

     

       126
       126
       +
           </para>

     

       127
       127
       +
          </listitem>

     

       111
       128
        
         </itemizedlist>

     

       112
       129
        
        </section>

     

       113
       130

+121 -51

nixos/modules/system/boot/initrd-ssh.nix

···

       10
       10
        
       

     

       11
       11
        
       {

     

       12
       12
        
       

     

       13
       13
       -
         options = {

     

       14
       14
       -
       

     

       15
       15
       -
           boot.initrd.network.ssh.enable = mkOption {

     

       13
       13
       +
         options.boot.initrd.network.ssh = {

     

       14
       14
       +
           enable = mkOption {

     

       16
       15
        
             type = types.bool;

     

       17
       16
        
             default = false;

     

       18
       17
        
             description = ''

     

       19
       18
        
               Start SSH service during initrd boot. It can be used to debug failing

     

       20
       19
        
               boot on a remote server, enter pasphrase for an encrypted partition etc.

     

       21
       20
        
               Service is killed when stage-1 boot is finished.

     

       21
       21
       +
       

     

       22
       22
       +
               The sshd configuration is largely inherited from

     

       23
       23
       +
               <option>services.openssh</option>.

     

       22
       24
        
             '';

     

       23
       25
        
           };

     

       24
       26
        
       

     

       25
       25
       -
           boot.initrd.network.ssh.port = mkOption {

     

       27
       27
       +
           port = mkOption {

     

       26
       28
        
             type = types.int;

     

       27
       29
        
             default = 22;

     

       28
       30
        
             description = ''

     
···

       30
       32
        
             '';

     

       31
       33
        
           };

     

       32
       34
        
       

     

       33
       33
       -
           boot.initrd.network.ssh.shell = mkOption {

     

       35
       35
       +
           shell = mkOption {

     

       34
       36
        
             type = types.str;

     

       35
       37
        
             default = "/bin/ash";

     

       36
       38
        
             description = ''

     
···

       38
       40
        
             '';

     

       39
       41
        
           };

     

       40
       42
        
       

     

       41
       41
       -
           boot.initrd.network.ssh.hostRSAKey = mkOption {

     

       42
       42
       -
             type = types.nullOr types.path;

     

       43
       43
       -
             default = null;

     

       43
       43
       +
           hostKeys = mkOption {

     

       44
       44
       +
             type = types.listOf (types.either types.str types.path);

     

       45
       45
       +
             default = [];

     

       46
       46
       +
             example = [

     

       47
       47
       +
               "/etc/secrets/initrd/ssh_host_rsa_key"

     

       48
       48
       +
               "/etc/secrets/initrd/ssh_host_ed25519_key"

     

       49
       49
       +
             ];

     

       44
       50
        
             description = ''

     

       45
       45
       -
               RSA SSH private key file in the Dropbear format.

     

       51
       51
       +
               Specify SSH host keys to import into the initrd.

     

       46
       52
        
       

     

       47
       47
       -
               WARNING: Unless your bootloader supports initrd secrets, this key is

     

       48
       48
       -
               contained insecurely in the global Nix store. Do NOT use your regular

     

       49
       49
       -
               SSH host private keys for this purpose or you'll expose them to

     

       50
       50
       -
               regular users!

     

       51
       51
       -
             '';

     

       52
       52
       -
           };

     

       53
       53
       -
       

     

       54
       54
       -
           boot.initrd.network.ssh.hostDSSKey = mkOption {

     

       55
       55
       -
             type = types.nullOr types.path;

     

       56
       56
       -
             default = null;

     

       57
       57
       -
             description = ''

     

       58
       58
       -
               DSS SSH private key file in the Dropbear format.

     

       59
       59
       -
       

     

       60
       60
       -
               WARNING: Unless your bootloader supports initrd secrets, this key is

     

       61
       61
       -
               contained insecurely in the global Nix store. Do NOT use your regular

     

       62
       62
       -
               SSH host private keys for this purpose or you'll expose them to

     

       63
       63
       -
               regular users!

     

       64
       64
       -
             '';

     

       65
       65
       -
           };

     

       53
       53
       +
               To generate keys, use

     

       54
       54
       +
               <citerefentry><refentrytitle>ssh-keygen</refentrytitle><manvolnum>1</manvolnum></citerefentry>:

     

       66
       55
        
       

     

       67
       67
       -
           boot.initrd.network.ssh.hostECDSAKey = mkOption {

     

       68
       68
       -
             type = types.nullOr types.path;

     

       69
       69
       -
             default = null;

     

       70
       70
       -
             description = ''

     

       71
       71
       -
               ECDSA SSH private key file in the Dropbear format.

     

       56
       56
       +
               <screen>

     

       57
       57
       +
               <prompt># </prompt>ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key

     

       58
       58
       +
               <prompt># </prompt>ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed_25519_key

     

       59
       59
       +
               </screen>

     

       72
       60
        
       

     

       73
       73
       -
               WARNING: Unless your bootloader supports initrd secrets, this key is

     

       74
       74
       -
               contained insecurely in the global Nix store. Do NOT use your regular

     

       75
       75
       -
               SSH host private keys for this purpose or you'll expose them to

     

       76
       76
       -
               regular users!

     

       61
       61
       +
               <warning>

     

       62
       62
       +
                 <para>

     

       63
       63
       +
                   Unless your bootloader supports initrd secrets, these keys

     

       64
       64
       +
                   are stored insecurely in the global Nix store. Do NOT use

     

       65
       65
       +
                   your regular SSH host private keys for this purpose or

     

       66
       66
       +
                   you'll expose them to regular users!

     

       67
       67
       +
                 </para>

     

       68
       68
       +
                 <para>

     

       69
       69
       +
                   Additionally, even if your initrd supports secrets, if

     

       70
       70
       +
                   you're using initrd SSH to unlock an encrypted disk then

     

       71
       71
       +
                   using your regular host keys exposes the private keys on

     

       72
       72
       +
                   your unencrypted boot partition.

     

       73
       73
       +
                 </para>

     

       74
       74
       +
               </warning>

     

       77
       75
        
             '';

     

       78
       76
        
           };

     

       79
       77
        
       

     

       80
       80
       -
           boot.initrd.network.ssh.authorizedKeys = mkOption {

     

       78
       78
       +
           authorizedKeys = mkOption {

     

       81
       79
        
             type = types.listOf types.str;

     

       82
       80
        
             default = config.users.users.root.openssh.authorizedKeys.keys;

     

       81
       81
       +
             defaultText = "config.users.users.root.openssh.authorizedKeys.keys";

     

       83
       82
        
             description = ''

     

       84
       83
        
               Authorized keys for the root user on initrd.

     

       85
       85
       -
               Note that Dropbear doesn't support OpenSSH's Ed25519 key type.

     

       86
       84
        
             '';

     

       87
       85
        
           };

     

       88
       88
       -
       

     

       89
       86
        
         };

     

       90
       87
        
       

     

       91
       91
       -
         config = mkIf (config.boot.initrd.network.enable && cfg.enable) {

     

       88
       88
       +
         imports =

     

       89
       89
       +
           map (opt: mkRemovedOptionModule ([ "boot" "initrd" "network" "ssh" ] ++ [ opt ]) ''

     

       90
       90
       +
             The initrd SSH functionality now uses OpenSSH rather than Dropbear.

     

       91
       91
       +
       

     

       92
       92
       +
             If you want to keep your existing initrd SSH host keys, convert them with

     

       93
       93
       +
               $ dropbearconvert dropbear openssh dropbear_host_$type_key ssh_host_$type_key

     

       94
       94
       +
             and then set options.boot.initrd.network.ssh.hostKeys.

     

       95
       95
       +
           '') [ "hostRSAKey" "hostDSSKey" "hostECDSAKey" ];

     

       96
       96
       +
       

     

       97
       97
       +
         config = let

     

       98
       98
       +
           # Nix complains if you include a store hash in initrd path names, so

     

       99
       99
       +
           # as an awful hack we drop the first character of the hash.

     

       100
       100
       +
           initrdKeyPath = path: if isString path

     

       101
       101
       +
             then path

     

       102
       102
       +
             else let name = builtins.baseNameOf path; in

     

       103
       103
       +
               builtins.unsafeDiscardStringContext ("/etc/ssh/" +

     

       104
       104
       +
                 substring 1 (stringLength name) name);

     

       105
       105
       +
       

     

       106
       106
       +
           sshdCfg = config.services.openssh;

     

       107
       107
       +
       

     

       108
       108
       +
           sshdConfig = ''

     

       109
       109
       +
             Port ${toString cfg.port}

     

       110
       110
       +
       

     

       111
       111
       +
             PasswordAuthentication no

     

       112
       112
       +
             ChallengeResponseAuthentication no

     

       113
       113
       +
       

     

       114
       114
       +
             ${flip concatMapStrings cfg.hostKeys (path: ''

     

       115
       115
       +
               HostKey ${initrdKeyPath path}

     

       116
       116
       +
             '')}

     

       117
       117
       +
       

     

       118
       118
       +
             KexAlgorithms ${concatStringsSep "," sshdCfg.kexAlgorithms}

     

       119
       119
       +
             Ciphers ${concatStringsSep "," sshdCfg.ciphers}

     

       120
       120
       +
             MACs ${concatStringsSep "," sshdCfg.macs}

     

       121
       121
       +
       

     

       122
       122
       +
             LogLevel ${sshdCfg.logLevel}

     

       123
       123
       +
       

     

       124
       124
       +
             ${if sshdCfg.useDns then ''

     

       125
       125
       +
               UseDNS yes

     

       126
       126
       +
             '' else ''

     

       127
       127
       +
               UseDNS no

     

       128
       128
       +
             ''}

     

       129
       129
       +
           '';

     

       130
       130
       +
         in mkIf (config.boot.initrd.network.enable && cfg.enable) {

     

       92
       131
        
           assertions = [

     

       93
       93
       -
             { assertion = cfg.authorizedKeys != [];

     

       132
       132
       +
             {

     

       133
       133
       +
               assertion = cfg.authorizedKeys != [];

     

       94
       134
        
               message = "You should specify at least one authorized key for initrd SSH";

     

       95
       135
        
             }

     

       136
       136
       +
       

     

       137
       137
       +
             {

     

       138
       138
       +
               assertion = cfg.hostKeys != [];

     

       139
       139
       +
               message = ''

     

       140
       140
       +
                 You must now pre-generate the host keys for initrd SSH.

     

       141
       141
       +
                 See the boot.inird.network.ssh.hostKeys documentation

     

       142
       142
       +
                 for instructions.

     

       143
       143
       +
               '';

     

       144
       144
       +
             }

     

       96
       145
        
           ];

     

       97
       146
        
       

     

       98
       147
        
           boot.initrd.extraUtilsCommands = ''

     

       99
       99
       -
             copy_bin_and_libs ${pkgs.dropbear}/bin/dropbear

     

       148
       148
       +
             copy_bin_and_libs ${pkgs.openssh}/bin/sshd

     

       100
       149
        
             cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib

     

       101
       150
        
           '';

     

       102
       151
        
       

     

       103
       152
        
           boot.initrd.extraUtilsCommandsTest = ''

     

       104
       104
       -
             $out/bin/dropbear -V

     

       153
       153
       +
             # sshd requires a host key to check config, so we pass in the test's

     

       154
       154
       +
             echo -n ${escapeShellArg sshdConfig} |

     

       155
       155
       +
               $out/bin/sshd -t -f /dev/stdin \

     

       156
       156
       +
               -h ${../../../tests/initrd-network-ssh/ssh_host_ed25519_key}

     

       105
       157
        
           '';

     

       106
       158
        
       

     

       107
       159
        
           boot.initrd.network.postCommands = ''

     

       108
       160
        
             echo '${cfg.shell}' > /etc/shells

     

       109
       161
        
             echo 'root:x:0:0:root:/root:${cfg.shell}' > /etc/passwd

     

       162
       162
       +
             echo 'sshd:x:1:1:sshd:/var/empty:/bin/nologin' >> /etc/passwd

     

       110
       163
        
             echo 'passwd: files' > /etc/nsswitch.conf

     

       111
       164
        
       

     

       112
       112
       -
             mkdir -p /var/log

     

       165
       165
       +
             mkdir -p /var/log /var/empty

     

       113
       166
        
             touch /var/log/lastlog

     

       114
       167
        
       

     

       115
       115
       -
             mkdir -p /etc/dropbear

     

       168
       168
       +
             mkdir -p /etc/ssh

     

       169
       169
       +
             echo -n ${escapeShellArg sshdConfig} > /etc/ssh/sshd_config

     

       170
       170
       +
       

     

       171
       171
       +
             echo "export PATH=$PATH" >> /etc/profile

     

       172
       172
       +
             echo "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH" >> /etc/profile

     

       116
       173
        
       

     

       117
       174
        
             mkdir -p /root/.ssh

     

       118
       175
        
             ${concatStrings (map (key: ''

     

       119
       176
        
               echo ${escapeShellArg key} >> /root/.ssh/authorized_keys

     

       120
       177
        
             '') cfg.authorizedKeys)}

     

       121
       178
        
       

     

       122
       122
       -
             dropbear -s -j -k -E -p ${toString cfg.port} ${optionalString (cfg.hostRSAKey == null && cfg.hostDSSKey == null && cfg.hostECDSAKey == null) "-R"}

     

       179
       179
       +
             ${flip concatMapStrings cfg.hostKeys (path: ''

     

       180
       180
       +
               # keys from Nix store are world-readable, which sshd doesn't like

     

       181
       181
       +
               chmod 0600 "${initrdKeyPath path}"

     

       182
       182
       +
             '')}

     

       183
       183
       +
       

     

       184
       184
       +
             /bin/sshd -e

     

       123
       185
        
           '';

     

       124
       186
        
       

     

       125
       125
       -
           boot.initrd.secrets =

     

       126
       126
       -
            (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //

     

       127
       127
       -
            (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //

     

       128
       128
       -
            (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });

     

       187
       187
       +
           boot.initrd.postMountCommands = ''

     

       188
       188
       +
             # Stop sshd cleanly before stage 2.

     

       189
       189
       +
             #

     

       190
       190
       +
             # If you want to keep it around to debug post-mount SSH issues,

     

       191
       191
       +
             # run `touch /.keep_sshd` (either from an SSH session or in

     

       192
       192
       +
             # another initrd hook like preDeviceCommands).

     

       193
       193
       +
             if ! [ -e /.keep_sshd ]; then

     

       194
       194
       +
               pkill -x sshd

     

       195
       195
       +
             fi

     

       196
       196
       +
           '';

     

       129
       197
        
       

     

       198
       198
       +
           boot.initrd.secrets = listToAttrs

     

       199
       199
       +
             (map (path: nameValuePair (initrdKeyPath path) path) cfg.hostKeys);

     

       130
       200
        
         };

     

       131
       201
        
       

     

       132
       202
        
       }

+4 -1

nixos/modules/system/boot/stage-1.nix

···

       142
       142
        
                    let source' = if source == null then dest else source; in

     

       143
       143
        
                      ''

     

       144
       144
        
                         mkdir -p $(dirname "$out/secrets/${dest}")

     

       145
       145
       -
                         cp -a ${source'} "$out/secrets/${dest}"

     

       145
       145
       +
                         # Some programs (e.g. ssh) doesn't like secrets to be

     

       146
       146
       +
                         # symlinks, so we use `cp -L` here to match the

     

       147
       147
       +
                         # behaviour when secrets are natively supported.

     

       148
       148
       +
                         cp -Lr ${source'} "$out/secrets/${dest}"

     

       146
       149
        
                       ''

     

       147
       150
        
                 ) config.boot.initrd.secrets))

     

       148
       151
        
              }

+16 -6

nixos/tests/initrd-network-ssh/default.nix

···

       3
       3
        
       {

     

       4
       4
        
         name = "initrd-network-ssh";

     

       5
       5
        
         meta = with lib.maintainers; {

     

       6
       6
       -
           maintainers = [ willibutz ];

     

       6
       6
       +
           maintainers = [ willibutz emily ];

     

       7
       7
        
         };

     

       8
       8
        
       

     

       9
       9
        
         nodes = with lib; {

     
···

       17
       17
        
                 enable = true;

     

       18
       18
        
                 ssh = {

     

       19
       19
        
                   enable = true;

     

       20
       20
       -
                   authorizedKeys = [ "${readFile ./openssh.pub}" ];

     

       20
       20
       +
                   authorizedKeys = [ (readFile ./id_ed25519.pub) ];

     

       21
       21
        
                   port = 22;

     

       22
       22
       -
                   hostRSAKey = ./dropbear.priv;

     

       22
       22
       +
                   hostKeys = [ ./ssh_host_ed25519_key ];

     

       23
       23
        
                 };

     

       24
       24
        
               };

     

       25
       25
        
               boot.initrd.preLVMCommands = ''

     
···

       42
       42
        
                     "${toString (head (splitString " " (

     

       43
       43
        
                       toString (elemAt (splitString "\n" config.networking.extraHosts) 2)

     

       44
       44
        
                     )))} "

     

       45
       45
       -
                     "${readFile ./dropbear.pub}"

     

       45
       45
       +
                     "${readFile ./ssh_host_ed25519_key.pub}"

     

       46
       46
        
                   ];

     

       47
       47
        
                 };

     

       48
       48
        
                 sshKey = {

     

       49
       49
       -
                   source = ./openssh.priv; # dont use this anywhere else

     

       49
       49
       +
                   source = ./id_ed25519;

     

       50
       50
        
                   mode = "0600";

     

       51
       51
        
                 };

     

       52
       52
        
               };

     
···

       56
       56
        
         testScript = ''

     

       57
       57
        
           start_all()

     

       58
       58
        
           client.wait_for_unit("network.target")

     

       59
       59
       -
           client.wait_until_succeeds("ping -c 1 server")

     

       59
       59
       +
       

     

       60
       60
       +
       

     

       61
       61
       +
           def ssh_is_up(_) -> bool:

     

       62
       62
       +
               status, _ = client.execute("nc -z server 22")

     

       63
       63
       +
               return status == 0

     

       64
       64
       +
       

     

       65
       65
       +
       

     

       66
       66
       +
           with client.nested("waiting for SSH server to come up"):

     

       67
       67
       +
               retry(ssh_is_up)

     

       68
       68
       +
       

     

       69
       69
       +
       

     

       60
       70
        
           client.succeed(

     

       61
       71
        
               "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'touch /fnord'"

     

       62
       72
        
           )

nixos/tests/initrd-network-ssh/dropbear.priv

This is a binary file and will not be displayed.

-1

nixos/tests/initrd-network-ssh/dropbear.pub

···

       1
       1
       -
       ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzJ0OniLB91MpPC86I1m3wwJeAc+Gme7bAuaLIU/cSfPwxT5NO7MfCp0Pu94gYDKtDXMs/wXg0bTAVDeAFFkdIj6kBBumEmQLCTL48q2UxDIXVLT/E/AAgj6q7WwgCg7fwm4Vjn4z7aUyBx8EfRy+5/SQyeYla3D/lFYgMi5x4D6J+yeR+JPAptDE/IR5IizNV7mY0ZcoXYyHrrehI1tTYEEqjX13ZqS4OCBFWwHe1QHhRNM+jHhcATbgikjAj8FyFPtLvc+dSVtkuhQktQl36Bi8zMUQcV6+mM7Ln6DBcDlM9urHKLYPTWmUAyhxM955iglOn5z0RaAIcyNMT6hz0rHaNf0BIlmbXoTC0XGjHh/OnoOEC/zg0JqgQTnPiU45K4TnRSSXp2GfiDfiQAK0+HaXACkjuFR68u7WCZpB1Bse1OgKNClFqtRhIr5DilUb2/e5DCCmFkddMUcjmYqzZdbXNt7fo8CFULe+mbiCp8+tMg4aRTaDZ/Hk93nCvGE5TP2ypEMbfL6nRVKvXOjhdvSQQgKwx+O003FDEHCSG0Bpageh7yVpna+SPrbGklce7MjTpbx3iIwmvKpQ6asnK1L3KkahpY1S3NhQ+/S3Gs8KWQ5LAU+d3xiPX3jfIVHsCIIyxHDbwcJvxM4MFBFQpqRMD6E+LoM9RHjl4C9k2iQ== tmtynkky@duuni

+3 -5

nixos/tests/initrd-network-ssh/generate-keys.nix

···

       1
       1
        
       with import ../../.. {};

     

       2
       2
        
       

     

       3
       3
        
       runCommand "gen-keys" {

     

       4
       4
       -
           buildInputs = [ dropbear openssh ];

     

       4
       4
       +
           buildInputs = [ openssh ];

     

       5
       5
        
         }

     

       6
       6
        
         ''

     

       7
       7
        
           mkdir $out

     

       8
       8
       -
           dropbearkey -t rsa -f $out/dropbear.priv -s 4096 | sed -n 2p > $out/dropbear.pub

     

       9
       9
       -
           ssh-keygen -q -t rsa -b 4096 -N "" -f client

     

       10
       10
       -
           mv client $out/openssh.priv

     

       11
       11
       -
           mv client.pub $out/openssh.pub

     

       8
       8
       +
           ssh-keygen -q -t ed25519 -N "" -f $out/ssh_host_ed25519_key

     

       9
       9
       +
           ssh-keygen -q -t ed25519 -N "" -f $out/id_ed25519

     

       12
       10
        
         ''

nixos/tests/initrd-network-ssh/id_ed25519

···

       1
       1
       +
       -----BEGIN OPENSSH PRIVATE KEY-----

     

       2
       2
       +
       b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW

     

       3
       3
       +
       QyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfwAAAJi/AJZMvwCW

     

       4
       4
       +
       TAAAAAtzc2gtZWQyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfw

     

       5
       5
       +
       AAAEAPLjQusjrB90Lk3996G3AbtTeK+XweNgxaegYnml/A/RVxf7fZiqKDblHFEDxt6X9/

     

       6
       6
       +
       rTjBXSn/re6b46S7/e9/AAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==

     

       7
       7
       +
       -----END OPENSSH PRIVATE KEY-----

nixos/tests/initrd-network-ssh/id_ed25519.pub

···

       1
       1
       +
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/ nixbld@localhost

-51

nixos/tests/initrd-network-ssh/openssh.priv

···

       1
       1
       -
       -----BEGIN RSA PRIVATE KEY-----

     

       2
       2
       -
       MIIJKAIBAAKCAgEA7+9A2PCPOTAlFmrablrUWA+VZdAuLfM6JXeHsOF7ZbC2F6lv

     

       3
       3
       -
       WmvDM925DQqhiAjcgWnt5WHWS5Y+b7lGnuzT7fyKegXd80nCRmqlpSG3srX0/lxR

     

       4
       4
       -
       aQAJLzfoDjcsF+ceswQo6GSsYnCHVxMNs007gbbVY3f7o+sWZtLdxJPD2iHvl5Zr

     

       5
       5
       -
       LK0d1RLMmU6cfIhIABlL0S8EWiv29RROepsCQnS0dnK2b+von1SCYoggvAMe2ToA

     

       6
       6
       -
       IAJ8+uqaYfGAyn9q8fjZiRHxLmKDq90tKoCUL5r/2dmEIE+t8T/3PfHoq1QzZts9

     

       7
       7
       -
       W9idhBdT21dEXBtGyoMtckp5njk5m82LQDYiOXkuSoIUhSOteh5g7fBv1BtVSERx

     

       8
       8
       -
       Jg3UeJjPeGKFwdnzapmAKC2w/6V8xcIINNA+fhZA7B9fD1RAi2TECZ+gyMYDc4T+

     

       9
       9
       -
       USlMSm9cfvSOrf2+5ngtFb84nHjqvClxCMLu+bCWK8HamqUzhE/a5LbR+48E7PyG

     

       10
       10
       -
       s3KV+sWFN9KOnakTjj/6iQhXZRhgeAK39F2XTk5Ms5Y+BRSStnMoMZA2grIV+jHi

     

       11
       11
       -
       1zbWokVqXPI5YRo5isR/PgtKAV6FfNWumcYoFJ9F40pMHQ6hJVEmtrCBx7EApSl3

     

       12
       12
       -
       mSGbQJUmilLC51qNhwQRbD//ZtpIrN82HTMKzZ6kj7kDCdsff+wsnkIXmmMCAwEA

     

       13
       13
       -
       AQKCAgA4tMINw6UF7hQF3VEsnbjr6xrzCiWv5HlMm5htPI1OdlpC81+G7ksfOfrf

     

       14
       14
       -
       UzDkFrwOtftsqBfem268Nvyy2OQprfMIbdSMCFWrEM9/XJ2u1gRGDYmMGF8TUtI8

     

       15
       15
       -
       cduw9oWx53zHl+uKBHBoKu+k/c7flFeQf63wisIroRCawhWau0SF/h3sXCndzuie

     

       16
       16
       -
       Hw8q+4aQx2m80bDkotlmCNuXbIU3MZ/pEql9gDLlXTLHmMaryM0EqAmZhx0ErGe6

     

       17
       17
       -
       WDqJIV4kPB0loSDwRoY6GzbugZ8ENUzcruTkQhCpIOYNNNw5idfwKkaxK1vm+SBv

     

       18
       18
       -
       iYt1fVjYyfH2vhVKSNoNsaGEloa1u4Dymt/FpFztEpRzHXcw93N8BdLxJ4OUhzm2

     

       19
       19
       -
       iAbpiyjniTIeAVVi7BUwLXh5WAx8nT0eeb1zKoZg1p1ciK5cYl1Uel7j8xRycsSW

     

       20
       20
       -
       3YgmtuPqY4Agbc9v3eXbQZNDk48JFMEqpIxk97FAkRYpzfxg5Qq14WJCp60CkdRt

     

       21
       21
       -
       T60hXy8lT/BcI8OWLfGJuBbsVLNRiC7PpwqRKQAinXSv134FpP7jrhpkMybs2oIS

     

       22
       22
       -
       5obRG7J5OfOTp925erG5mrpwqa3BPkgqx347Wj9z8quOZyuhi+XaPvqmPtvs5JOl

     

       23
       23
       -
       4RCqjt6RQlHm7xos9ZZGI4jDAIFaFWgyVZrYplOgwxWma4DTgQKCAQEA9+tizQRU

     

       24
       24
       -
       lF0lxNcEPvsFnYJo80Y+MQK9VdtlhR19YuSfwP1NCaMG1MhQ+PVBVmepOwJMRJR7

     

       25
       25
       -
       9PLfOouNMfixKBGP12dtStMuh7jowq/BxhRI6JWp3RhTZ1yJ9ouzHze7IDrEBa6w

     

       26
       26
       -
       p0hUu9H0Sbt51LXbC3JmTyhbdhfry559DfyGW1Ma/bv/pihL9B5Y7sNf1thNp1gi

     

       27
       27
       -
       GbQ9B+o2Yyw8ZD8zY+sl+aYDSWyCtcBV/KXEF74Bkfs/a5ExJ00X0jYj/TAp2ray

     

       28
       28
       -
       T4PY0FR8wN/O10bFLP9j+Xa/ywbcPhoj8nvVRIg9VfWT/QaEd+KR0EZVxdjCCqne

     

       29
       29
       -
       enbSQksTpAZNwQKCAQEA98E+BMmS+yHUVUhNZABtQ5avwuV4+DoSN8KTp3xwQ0CH

     

       30
       30
       -
       m9fWxSDs12FdyMhDxrJPeywvHtZ18/7cl3dr8wnFVE0s4ongnRDXsNk5xN6J3AaO

     

       31
       31
       -
       KqW4HF9cbwZqzLILy8TrO+EK/EQV9FypbrxqvxAlP1kezIA2CJNzVRAgimSuV/H7

     

       32
       32
       -
       05HTnp5W06fjtEf8U1CUrdNetoSROUo1j/IMGPYGlsBFYAGrj5y/BlKd+3T3kjRp

     

       33
       33
       -
       Xje7HpiykjrZHn0WDp04Ln+u9nveEewXmHKch313emt7HpW0xspp8JM8OZtEKozk

     

       34
       34
       -
       D5PfYdBfMJJOUlqovCCzTTJ6kNOahknKXFeO/qs5IwKCAQEAjF0/zhWikXF/fcfD

     

       35
       35
       -
       Bql2z2vTYdEmSvdjHSYff1Nn90K71DdVk5wytOxJM/sfp/z+yoMNjVKIL/IGQw5Z

     

       36
       36
       -
       va4xFx+CUhGjxlZ0pLEjT37U9gHsGYsK5jvslLvG/MixfH5AOwoqi5ERQVTpbIF9

     

       37
       37
       -
       jvVPEAh6YSu/ExglWGJIxTsRUIblxvTxdjEnl/p+rlM0RNJnA6vpo1J51BXA7CdF

     

       38
       38
       -
       7bZQ5u0Feo/bK1I70ClYg/DGfkmYEV0pZG5cxNkqfDbgwsqWa7YGLGd94xkh+ymq

     

       39
       39
       -
       jETqxeWyozxhbQ83nYpfzeVc7t//qlJ8b5uf0wUKoRmtNr9rtp13lzP/21REzPXW

     

       40
       40
       -
       w+oxwQKCAQAoAf2Y2lAw25KlPuq4ZlU+n9u8FkBFnWMJvBMJ7c9XHNmJMf6NkLaO

     

       41
       41
       -
       RTvWy3geYvbwxf7J9QnRH+vRTciR05cY+Olxn6A03N5nwXxRrToH3MsiWeZ0NnX/

     

       42
       42
       -
       u8KNUYcUHbV60ulqOThuYHQ/3I9EUUAijaqqjV2sXts19ke68W0x6HKpBJhuudT9

     

       43
       43
       -
       ktPzbdhyP8Xyl/pocNnerXwexZBsi3Ye6+eIDFz+8OnsBHVcgNPluS72tvsxgqj7

     

       44
       44
       -
       ciNTiBGCxKKo55eCWBhRPpXE2WUrf/hGPYsBMl2h6FfZMH1+M/N7B4tgdJmS+woU

     

       45
       45
       -
       Ftws8lTjJEiwA6HFN1ZxrwLNjJobx9yPAoIBAE0igsBuWWn6rXeOPylYg4264XOq

     

       46
       46
       -
       8gb94pte2n9amDgCzyCn8m6AL3snLC/AoCD19DK+gyK0ukoesXPa3iX6w2xv69ZC

     

       47
       47
       -
       urDx36Jhd4zrJb4QsFPoeKfDP+UvNVZaS41vipRRzY/y11em15prUZ4U8FA/UT1Y

     

       48
       48
       -
       FzkBo9r6iUZRnyBLppMuEfWASDtuRNmeIHynoT1AcQOH3l9vR210iEpmAuJr0CYA

     

       49
       49
       -
       bvTuz3UzzGGEAuIUvuaiRtkfKY52jBmiEr7SSPCr1HvLj3Ccz8bgjgR2kiXmcU50

     

       50
       50
       -
       1zLnaPAD44LZ/0Fjqj+PimQGT6K7CNXPllmYh7MvoU52g3SVPf6rHlIR0Nc=

     

       51
       51
       -
       -----END RSA PRIVATE KEY-----

-1

nixos/tests/initrd-network-ssh/openssh.pub

···

       1
       1
       -
       ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDv70DY8I85MCUWatpuWtRYD5Vl0C4t8zold4ew4XtlsLYXqW9aa8Mz3bkNCqGICNyBae3lYdZLlj5vuUae7NPt/Ip6Bd3zScJGaqWlIbeytfT+XFFpAAkvN+gONywX5x6zBCjoZKxicIdXEw2zTTuBttVjd/uj6xZm0t3Ek8PaIe+XlmssrR3VEsyZTpx8iEgAGUvRLwRaK/b1FE56mwJCdLR2crZv6+ifVIJiiCC8Ax7ZOgAgAnz66pph8YDKf2rx+NmJEfEuYoOr3S0qgJQvmv/Z2YQgT63xP/c98eirVDNm2z1b2J2EF1PbV0RcG0bKgy1ySnmeOTmbzYtANiI5eS5KghSFI616HmDt8G/UG1VIRHEmDdR4mM94YoXB2fNqmYAoLbD/pXzFwgg00D5+FkDsH18PVECLZMQJn6DIxgNzhP5RKUxKb1x+9I6t/b7meC0VvziceOq8KXEIwu75sJYrwdqapTOET9rkttH7jwTs/IazcpX6xYU30o6dqROOP/qJCFdlGGB4Arf0XZdOTkyzlj4FFJK2cygxkDaCshX6MeLXNtaiRWpc8jlhGjmKxH8+C0oBXoV81a6ZxigUn0XjSkwdDqElUSa2sIHHsQClKXeZIZtAlSaKUsLnWo2HBBFsP/9m2kis3zYdMwrNnqSPuQMJ2x9/7CyeQheaYw== tmtynkky@duuni

nixos/tests/initrd-network-ssh/ssh_host_ed25519_key

···

       1
       1
       +
       -----BEGIN OPENSSH PRIVATE KEY-----

     

       2
       2
       +
       b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW

     

       3
       3
       +
       QyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIAAAAJg0WGFGNFhh

     

       4
       4
       +
       RgAAAAtzc2gtZWQyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIA

     

       5
       5
       +
       AAAEA0Hjs7LfFPdTf3ThGx6GNKvX0ItgzgXs91Z3oGIaF6S8/0zPqqXF1CoDiiauBs6VWz

     

       6
       6
       +
       FIY40Imy2Nb3Oqq5qOUgAAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==

     

       7
       7
       +
       -----END OPENSSH PRIVATE KEY-----

nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub

···

       1
       1
       +
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost