Factorise users configurations #20

Niols · 2024-11-20T17:39:00+01:00

Niols commented

2024-11-20 17:39:00 +01:00

This PR merges all users-related configurations from VMs in infra/ into a infra/common/users.nix module. More factorisation will come in subsequent PRs. It builds on top of Fediversity/Fediversity#19.

While merging these users configurations, I have come across some variations. Similarly to what I did in Fediversity/Fediversity#19, I have taking the superset of those things. However, I think I can clean things up a bit. In particular:

Some machines did not have a hashedPassword for root and now they do. @koen @kevin> I guess that is fine, but should we not just remove password login for root entirely and remove this hashedPassword?
Some machines did not have a valentin user and now they do. @fricklerhandwerk> Do you actually need that? Wouldn't your SSH key on the root user suffice? In which case, which one:
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJzgwAYAoMexc1fBJxU08YmsiU9T4Ua8QFeE4/kZNZ5
```
(or both) (I believe both are yours but I am not entirely sure)

This PR merges all users-related configurations from VMs in `infra/` into a `infra/common/users.nix` module. More factorisation will come in subsequent PRs. It builds on top of https://git.fediversity.eu/Fediversity/Fediversity/pulls/19. While merging these users configurations, I have come across some variations. Similarly to what I did in https://git.fediversity.eu/Fediversity/Fediversity/pulls/19, I have taking the superset of those things. However, I think I can clean things up a bit. In particular: - Some machines did not have a `hashedPassword` for `root` and now they do. @koen @kevin> I guess that is fine, but should we not just remove password login for `root` entirely and remove this `hashedPassword`? - Some machines did not have a `valentin` user and now they do. @fricklerhandwerk> Do you actually need that? Wouldn't your SSH key on the `root` user suffice? In which case, which one: ``` ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJzgwAYAoMexc1fBJxU08YmsiU9T4Ua8QFeE4/kZNZ5 ``` (or both) (I believe both are yours but I am not entirely sure)

Niols added 4 commits

2024-11-20 17:39:01 +01:00

Move users config of vm02116 to infra/common 262067fa4c

Factorise users config of vm02179 into infra/common 56f54e8ebd

Factorise users config of vm02186 into infra/common 2fe8d72840

Factorise users config of vm02187 into infra/common

/ check-pre-commit (pull_request) Successful in 24s

Details

83e55c89d6

Niols referenced this pull request

2024-11-20 17:43:47 +01:00

Factorise hardware configurations #21

Niols referenced this pull request

2024-11-20 17:47:16 +01:00

Cleanup and consolidate remaining configurations #23

fricklerhandwerk approved these changes

2024-11-20 23:03:45 +01:00

fricklerhandwerk left a comment

I agree on disabling sudo passwords, and removing passwords altogether. May even disable root login, as @koen noted on Matrix.

infra/common/users.nix Outdated

					
				@ -0,0 +14,4 @@

				      isNormalUser = true;

				      extraGroups = [ "wheel" ];

				      openssh.authorizedKeys.keys = [

				        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJzgwAYAoMexc1fBJxU08YmsiU9T4Ua8QFeE4/kZNZ5"

this key is good

kevin commented

2024-11-21 10:29:32 +01:00

the reason some have an hashed password and some don't is because we added that option later on so older machines don't have it. I would recommend removing password login for root in case you need to save the machine from the terminal in the vm environment.

as for the user for valetin like you earlier discussed with koen in de matrix its better if don't allow a direct login to root over ssh so the user is needed

the reason some have an hashed password and some don't is because we added that option later on so older machines don't have it. I would recommend removing password login for root in case you need to save the machine from the terminal in the vm environment. as for the user for valetin like you earlier discussed with koen in de matrix its better if don't allow a direct login to root over ssh so the user is needed

Niols commented

2024-11-21 11:39:01 +01:00

@fricklerhandwerk> Is this your key?

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg

@fricklerhandwerk> Is this your key? ``` ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg ```

Niols force-pushed factorise-users-config from 83e55c89d6

/ check-pre-commit (pull_request) Successful in 24s

Details

to 67eddccc40

/ check-pre-commit (pull_request) Successful in 21s

Details

2024-11-21 11:45:04 +01:00

Compare

Niols referenced this pull request from a commit

2024-11-21 11:45:41 +01:00

Factorise users configurations (#20)

Niols commented

2024-11-21 11:48:25 +01:00

Merged with 1e8174799b.

Merged with 1e8174799bbfce5dec4017306c3e2be26680dc4e.

Niols closed this pull request

2024-11-21 11:48:25 +01:00

Niols referenced this pull request

2024-11-21 11:49:14 +01:00

Disable root SSH authentication altogether #24

Niols commented

2024-11-21 11:52:49 +01:00

Thank you for your comments, @kevin. I applied them as best I could. The only one I did not yet apply is to disable root SSH authentication, because NixOps4 doesn't allow that yet. It is tracked in Fediversity/Fediversity#24.

Thank you for your comments, @kevin. I applied them as best I could. The only one I did not yet apply is to disable root SSH authentication, because NixOps4 doesn't allow that yet. It is tracked in https://git.fediversity.eu/Fediversity/Fediversity/issues/24.