Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sshd: Add restartTrigger for sshd_config #53050

Merged
merged 1 commit into from
Jan 2, 2019
Merged

sshd: Add restartTrigger for sshd_config #53050

merged 1 commit into from
Jan 2, 2019

Conversation

ajs124
Copy link
Member

@ajs124 ajs124 commented Dec 29, 2018

Motivation for this change

Changing sshd options (e.g. via extraConfig) does not restart the ssh service, currently.

IMO this is expected behaviour, which this fixes.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@GrahamcOfBorg GrahamcOfBorg added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild 10.rebuild-linux: 0 This PR does not cause any packages to rebuild labels Dec 29, 2018
@infinisil
Copy link
Member

Care needs to be taken. openssh can't simply be restarted because some users might depend on its connection to access the machine itself. If the config has a single bug, openssh could fail to restart and lock users out. I'm not entirely sure myself how it all works currently (active connections stay alive or so), but this should be reviewed and tested with care.

infinisil
infinisil approved these changes Dec 29, 2018
View reviewed changes
Copy link
Member

@infinisil infinisil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@volth I see, thanks. This looks good to me then.

@ajs124
Copy link
Member Author

ajs124 commented Dec 29, 2018

@volth how is this different from #48658?

I didn't see your PR before submitting this, sorry.

xeji
xeji reviewed Jan 1, 2019
View reviewed changes
nixos/modules/services/networking/ssh/sshd.nix Outdated
@@ -387,6 +387,10 @@ in
Restart = "always";
Type = "simple";
});

restartTriggers = [
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this works?
I believe restartTriggers should be an attribute of service (one level up), not of serviceConfig.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right, it should probably be and attribute of service instead of serviceConfig.

How about I close this and someone merges #48658.

@ajs124 @fpletz
sshd: Add restartTrigger for sshd_config
325e314 
Co-Authored-By: Franz Pletz <fpletz@fnordicwalking.de>
@fpletz fpletz force-pushed the openssh_extraconfig_restart branch from 06f7e65 to 325e314 Compare January 2, 2019 19:12
@fpletz
Copy link
Member

fpletz commented Jan 2, 2019

Rebased, fixed and only adding the restartTriggers now when not socket-activated via systemd.

@fpletz fpletz merged commit 0b25b9b into NixOS:master Jan 2, 2019
@fpletz fpletz mentioned this pull request Jan 2, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xeji xeji xeji left review comments

@infinisil infinisil infinisil approved these changes

Assignees
No one assigned
Labels
6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild 10.rebuild-linux: 0 This PR does not cause any packages to rebuild
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ajs124 @infinisil @fpletz @xeji @GrahamcOfBorg