Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/ssh: Add pkcs11 support for ssh agent #49755

Closed
wants to merge 1 commit into from

Conversation

@arianvp
Copy link
Member

@arianvp arianvp commented Nov 4, 2018

ssh-agent needs to get an explicit, non-symlinked whitelist of
directories that contains pkcs11 providers (which are shared libraries).
By default this is /lib and /usr/lib, which of course have no effect
in NixOS.

When the user tries to explicitly override this whitelist using
the -P flag of ssh-agent, and set it to
-P /run/current-system/sw/lib/*
this will still not work, as the ssh-add command resolves symlinks
before sending a request to ssh-agent. e.g.

ssh-add -s /run/current-system/sw/lib/opensc-pkcs11.so

will result in an
refusing PKCS#11 add of "/nix/store/xxxx=-opensc-xx/lib/opensc-pkcs11.so"

To work around this issue, allow the user to explicitly tell what
nix packages ssh-agent should whitelist through the NixOS module system.

Example usage:

environment.systemPackages = [ pkgs.opensc pkgs.yubico-piv-tool ];
programs.ssh.agentPkcs11Whitelist = [ pkgs.opensc pkgs.yubico-piv-tool ];

Add pkcs11 provider to ssh-agent
$ ssh-add -s /run/current-system/sw/lib/opensc-pkcs11.so

Add pkcs11 provider to ssh-agent
$ ssh-add -s /run/current-system/sw/lib/libykcs11.so

Remove pkc11 provider from ssh-agent
$ ssh-add -e /run/current/system/sw/lib/libycks11.so

Motivation for this change
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

ssh-agent needs to get an explicit, non-symlinked whitelist of
directories that contains pkcs11 providers (which are shared libraries).
By default this is /lib and /usr/lib, which of course have no effect
in NixOS.

When the user tries to explicitly override this whitelist using
the -P flag of ssh-agent, and set it to
  -P /run/current-system/sw/lib/*
this will still not work, as the ssh-add command resolves symlinks
before sending a request to ssh-agent. e.g.

ssh-add -s /run/current-system/sw/lib/opensc-pkcs11.so

will result in an
  refusing PKCS#11 add of "/nix/store/xxxx=-opensc-xx/lib/opensc-pkcs11.so"

To work around this issue, allow the user to explicitly tell what
nix packages ssh-agent should whitelist through the NixOS module system.

Example usage:

environment.systemPackages = [ pkgs.opensc pkgs.yubico-piv-tool ];
programs.ssh.agentPkcs11Whitelist = [ pkgs.opensc pkgs.yubico-piv-tool ];

Add pkcs11 provider to ssh-agent
$ ssh-add -s /run/current-system/sw/lib/opensc-pkcs11.so

Add pkcs11 provider to ssh-agent
$ ssh-add -s /run/current-system/sw/lib/libykcs11.so

Remove pkc11 provider from ssh-agent
$ ssh-add -e /run/current/system/sw/lib/libycks11.so
@symphorien
Copy link
Contributor

@symphorien symphorien commented Nov 4, 2018

maybe adding a library to this list should add it automatically to ssh through the PKCS11Provider clause in /etc/ssh/ssh_config ? It seems cumbersome to have to add it by hand when it is already specified in /etc/nixos/configuration.nix
(NB: I don't use this so I may be missing something important)

@arianvp
Copy link
Member Author

@arianvp arianvp commented Nov 4, 2018

I tried that before, but ssh-agent actually ignores any value set in PKCS11Provider, and also ignores the AddKeysToAgent option. simply typing ssh-add without the -s <path> ignores PKCS11Provider setting.

You either set PKCS11Provider and provide the pin every time you type ssh,
or you type ssh-add -s /run/current-system/sw/lib/opensc.so once every session, and ssh finds it automatically.

The two components are not tightly integrated. This has been an open bug for 2 years already unfortunately. http://lists.mindrot.org/pipermail/openssh-bugs/2016-October/016961.html

@arianvp
Copy link
Member Author

@arianvp arianvp commented Nov 4, 2018

You can actually use PKCS11Provider without ssh-agent and don't even need the -P option for it... but then the PIN won't be cached in ssh-agent. The two options are totally mutually exclusive

@@ -84,6 +84,21 @@ in
'';
};


agentPkcs11Whitelist = mkOption {

This comment has been minimized.

@Mic92

Mic92 Nov 14, 2018
Contributor

Could it be named agentPkcs11Modules or are those not really loaded with this options?

This comment has been minimized.

@arianvp

arianvp Nov 14, 2018
Author Member

They are not loaded. They're only whitelisted. One always has to manually specify the path when invoking ssh-add -s <path to .so here> unfortunately. See the linked OpenSSH issue.

This comment has been minimized.

@Mic92

Mic92 Nov 14, 2018
Contributor

Ok. Just read the discussion above.

This comment has been minimized.

@Mic92

Mic92 Nov 14, 2018
Contributor

It would be nice to add an usage example you have in your description above also in the module description.

This comment has been minimized.

@arianvp

arianvp Nov 14, 2018
Author Member

Sounds like a good idea. Just hadn't bothered yet because docbook confuses me :P I'll have to read up on docbook first before figuring out how to format it correctly

@mmahut
Copy link
Member

@mmahut mmahut commented Aug 10, 2019

Are there any updates on this pull request, please?

@philandstuff
Copy link
Contributor

@philandstuff philandstuff commented Jan 13, 2020

Oops, looks like I accidentally reimplemented this in #71139; this can be closed (though some of the documentation could maybe be cherry-picked in?)

@arianvp
Copy link
Member Author

@arianvp arianvp commented Jan 13, 2020

@philandstuff thanks for pushing this forward regardless. Feel free to cherry-pick the docs

@arianvp arianvp closed this Jan 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

7 participants
You can’t perform that action at this time.