555ff68c37
In particular, this adds in the support for ephemeral ssh keys provided
by credentials (passed from container managers or VM hypervisors). This
was introduced upstream by 071155a1fbac ("ssh-generator: support
ssh.ephemeral-key.all-users").
This change alone isn't enough to get this working. We now get this
SELinux denial:
type=AVC msg=audit(1750939616.931:111): avc: denied { read } for pid=1159 comm="sshd-session" name="ssh.ephemeral-authorized_keys-all" dev="tmpfs" ino=2 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
I have tested this with `setenforce 0`, however, and it works.
Resolves: rhbz#2374928
17 lines
760 B
Desktop File
17 lines
760 B
Desktop File
[Unit]
|
|
Description=OpenSSH per-connection server daemon
|
|
Documentation=man:sshd(8) man:sshd_config(5)
|
|
Wants=sshd-keygen.target
|
|
After=sshd-keygen.target
|
|
# Migration for Fedora 38 change to remove group ownership for standard host keys
|
|
# See https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
|
|
Wants=ssh-host-keys-migration.service
|
|
|
|
[Service]
|
|
# Set option as empty variable to avoid warnings upon expanding the command line
|
|
# when the config file under /etc does not exist or is empty.
|
|
Environment=OPTIONS=
|
|
EnvironmentFile=-/etc/sysconfig/sshd
|
|
ExecStart=-/usr/sbin/sshd -i $OPTIONS -o "AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys"
|
|
StandardInput=socket
|
|
ImportCredential=ssh.ephemeral-authorized_keys-all
|