b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Use mktemp to create temporary files to hold ssh host keys and authorized keys when downloading them from the metadata server.

Browse source
This commit is contained in:
Russell O'Connor 2015-03-09 18:28:34 +00:00
parent fd1fb0403c
commit 1badfabc4d
1 changed files with 29 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
nixos/modules/virtualisation/google-compute-image.nix
View file

@ -143,34 +143,41 @@ in
umask 077
# Don't download the SSH key if it has already been downloaded
if ! [ -e /root/.ssh/authorized_keys ]; then
echo "obtaining SSH key..."
mkdir -m 0700 -p /root/.ssh
${wget} -O /root/authorized-keys-metadata http://metadata.google.internal/0.1/meta-data/authorized-keys
if [ $? -eq 0 -a -e /root/authorized-keys-metadata ]; then
cat /root/authorized-keys-metadata | cut -d: -f2- > /root/key.pub
if ! grep -q -f /root/key.pub /root/.ssh/authorized_keys; then
cat /root/key.pub >> /root/.ssh/authorized_keys
echo "new key added to authorized_keys"
fi
chmod 600 /root/.ssh/authorized_keys
echo "obtaining SSH key..."
mkdir -m 0700 -p /root/.ssh
AUTH_KEYS=$(mktemp) && {
${wget} -O $AUTH_KEYS http://metadata.google.internal/0.1/meta-data/authorized-keys
if [ $? -eq 0 -a -e $AUTH_KEYS ]; then
KEY_PUB=$(mktemp) && {
cat $AUTH_KEYS | cut -d: -f2- > $KEY_PUB
if ! grep -q -f $KEY_PUB /root/.ssh/authorized_keys; then
cat $KEY_PUB >> /root/.ssh/authorized_keys
echo "new key added to authorized_keys"
fi
chmod 600 /root/.ssh/authorized_keys
rm -f $KEY_PUB
}
fi
rm -f /root/key.pub /root/authorized-keys-metadata
rm -f $AUTH_KEYS
}
fi
countKeys=0
${flip concatMapStrings config.services.openssh.hostKeys (k :
let kName = baseNameOf k.path; in ''
echo "trying to obtain SSH private host key ${kName}"
${wget} -O /root/${kName} http://metadata.google.internal/0.1/meta-data/attributes/${kName} && :
if [ $? -eq 0 -a -e /root/${kName} ]; then
countKeys=$((countKeys+1))
mv -f /root/${kName} ${k.path}
echo "downloaded ${k.path}"
chmod 600 ${k.path}
${config.programs.ssh.package}/bin/ssh-keygen -y -f ${k.path} > ${k.path}.pub
chmod 644 ${k.path}.pub
fi
rm -f /root/${kName}
PRIV_KEY=$(mktemp) && {
echo "trying to obtain SSH private host key ${kName}"
${wget} -O $PRIV_KEY http://metadata.google.internal/0.1/meta-data/attributes/${kName} && :
if [ $? -eq 0 -a -e $PRIV_KEY ]; then
countKeys=$((countKeys+1))
mv -f $PRIV_KEY ${k.path}
echo "downloaded ${k.path}"
chmod 600 ${k.path}
${config.programs.ssh.package}/bin/ssh-keygen -y -f ${k.path} > ${k.path}.pub
chmod 644 ${k.path}.pub
fi
rm -f $PRIV_KEY
}
''
)}