gnu/services/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2016 David Craven <david@craven.ch>
   4 ;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
   5 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
   6 ;;;
   7 ;;; This file is part of GNU Guix.
   8 ;;;
   9 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  10 ;;; under the terms of the GNU General Public License as published by
  11 ;;; the Free Software Foundation; either version 3 of the License, or (at
  12 ;;; your option) any later version.
  13 ;;;
  14 ;;; GNU Guix is distributed in the hope that it will be useful, but
  15 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  16 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 ;;; GNU General Public License for more details.
  18 ;;;
  19 ;;; You should have received a copy of the GNU General Public License
  20 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 (define-module (gnu services ssh)
  23   #:use-module (gnu packages ssh)
  24   #:use-module (gnu packages admin)
  25   #:use-module (gnu services)
  26   #:use-module (gnu services shepherd)
  27   #:use-module (gnu system pam)
  28   #:use-module (gnu system shadow)
  29   #:use-module (guix gexp)
  30   #:use-module (guix records)
  31   #:use-module (guix modules)
  32   #:use-module (srfi srfi-26)
  33   #:use-module (ice-9 match)
  34   #:export (lsh-configuration
  35             lsh-configuration?
  36             lsh-service
  37             lsh-service-type
  38
  39             openssh-configuration
  40             openssh-configuration?
  41             openssh-service-type
  42
  43             dropbear-configuration
  44             dropbear-configuration?
  45             dropbear-service-type
  46             dropbear-service))
  47
  48 ;;; Commentary:
  49 ;;;
  50 ;;; This module implements secure shell (SSH) services.
  51 ;;;
  52 ;;; Code:
  53
  54 (define-record-type* <lsh-configuration>
  55   lsh-configuration make-lsh-configuration
  56   lsh-configuration?
  57   (lsh lsh-configuration-lsh
  58        (default lsh))
  59   (daemonic? lsh-configuration-daemonic?)
  60   (host-key lsh-configuration-host-key)
  61   (interfaces lsh-configuration-interfaces)
  62   (port-number lsh-configuration-port-number)
  63   (allow-empty-passwords? lsh-configuration-allow-empty-passwords?)
  64   (root-login? lsh-configuration-root-login?)
  65   (syslog-output? lsh-configuration-syslog-output?)
  66   (pid-file? lsh-configuration-pid-file?)
  67   (pid-file lsh-configuration-pid-file)
  68   (x11-forwarding? lsh-configuration-x11-forwarding?)
  69   (tcp/ip-forwarding? lsh-configuration-tcp/ip-forwarding?)
  70   (password-authentication? lsh-configuration-password-authentication?)
  71   (public-key-authentication? lsh-configuration-public-key-authentication?)
  72   (initialize? lsh-configuration-initialize?))
  73
  74 (define %yarrow-seed
  75   "/var/spool/lsh/yarrow-seed-file")
  76
  77 (define (lsh-initialization lsh host-key)
  78   "Return the gexp to initialize the LSH service for HOST-KEY."
  79   #~(begin
  80       (unless (file-exists? #$%yarrow-seed)
  81         (system* (string-append #$lsh "/bin/lsh-make-seed")
  82                  "--sloppy" "-o" #$%yarrow-seed))
  83
  84       (unless (file-exists? #$host-key)
  85         (mkdir-p (dirname #$host-key))
  86         (format #t "creating SSH host key '~a'...~%" #$host-key)
  87
  88         ;; FIXME: We're just doing a simple pipeline, but 'system' cannot be
  89         ;; used yet because /bin/sh might be dangling; factorize this somehow.
  90         (let* ((in+out (pipe))
  91                (keygen (primitive-fork)))
  92           (case keygen
  93             ((0)
  94              (close-port (car in+out))
  95              (close-fdes 1)
  96              (dup2 (fileno (cdr in+out)) 1)
  97              (execl (string-append #$lsh "/bin/lsh-keygen")
  98                     "lsh-keygen" "--server"))
  99             (else
 100              (let ((write-key (primitive-fork)))
 101                (case write-key
 102                  ((0)
 103                   (close-port (cdr in+out))
 104                   (close-fdes 0)
 105                   (dup2 (fileno (car in+out)) 0)
 106                   (execl (string-append #$lsh "/bin/lsh-writekey")
 107                          "lsh-writekey" "--server" "-o" #$host-key))
 108                  (else
 109                   (close-port (car in+out))
 110                   (close-port (cdr in+out))
 111                   (waitpid keygen)
 112                   (waitpid write-key))))))))))
 113
 114 (define (lsh-activation config)
 115   "Return the activation gexp for CONFIG."
 116   #~(begin
 117       (use-modules (guix build utils))
 118       (mkdir-p "/var/spool/lsh")
 119       #$(if (lsh-configuration-initialize? config)
 120             (lsh-initialization (lsh-configuration-lsh config)
 121                                 (lsh-configuration-host-key config))
 122             #t)))
 123
 124 (define (lsh-shepherd-service config)
 125   "Return a <shepherd-service> for lsh with CONFIG."
 126   (define lsh (lsh-configuration-lsh config))
 127   (define pid-file (lsh-configuration-pid-file config))
 128   (define pid-file? (lsh-configuration-pid-file? config))
 129   (define daemonic? (lsh-configuration-daemonic? config))
 130   (define interfaces (lsh-configuration-interfaces config))
 131
 132   (define lsh-command
 133     (append
 134      (cons (file-append lsh "/sbin/lshd")
 135            (if daemonic?
 136                (let ((syslog (if (lsh-configuration-syslog-output? config)
 137                                  '()
 138                                  (list "--no-syslog"))))
 139                  (cons "--daemonic"
 140                        (if pid-file?
 141                            (cons #~(string-append "--pid-file=" #$pid-file)
 142                                  syslog)
 143                            (cons "--no-pid-file" syslog))))
 144                (if pid-file?
 145                    (list #~(string-append "--pid-file=" #$pid-file))
 146                    '())))
 147      (cons* #~(string-append "--host-key="
 148                              #$(lsh-configuration-host-key config))
 149             #~(string-append "--password-helper=" #$lsh "/sbin/lsh-pam-checkpw")
 150             #~(string-append "--subsystems=sftp=" #$lsh "/sbin/sftp-server")
 151             "-p" (number->string (lsh-configuration-port-number config))
 152             (if (lsh-configuration-password-authentication? config)
 153                 "--password" "--no-password")
 154             (if (lsh-configuration-public-key-authentication? config)
 155                 "--publickey" "--no-publickey")
 156             (if (lsh-configuration-root-login? config)
 157                 "--root-login" "--no-root-login")
 158             (if (lsh-configuration-x11-forwarding? config)
 159                 "--x11-forward" "--no-x11-forward")
 160             (if (lsh-configuration-tcp/ip-forwarding? config)
 161                 "--tcpip-forward" "--no-tcpip-forward")
 162             (if (null? interfaces)
 163                 '()
 164                 (map (cut string-append "--interface=" <>)
 165                      interfaces)))))
 166
 167   (define requires
 168     (if (and daemonic? (lsh-configuration-syslog-output? config))
 169         '(networking syslogd)
 170         '(networking)))
 171
 172   (list (shepherd-service
 173          (documentation "GNU lsh SSH server")
 174          (provision '(ssh-daemon))
 175          (requirement requires)
 176          (start #~(make-forkexec-constructor (list #$@lsh-command)))
 177          (stop  #~(make-kill-destructor)))))
 178
 179 (define (lsh-pam-services config)
 180   "Return a list of <pam-services> for lshd with CONFIG."
 181   (list (unix-pam-service
 182          "lshd"
 183          #:allow-empty-passwords?
 184          (lsh-configuration-allow-empty-passwords? config))))
 185
 186 (define lsh-service-type
 187   (service-type (name 'lsh)
 188                 (extensions
 189                  (list (service-extension shepherd-root-service-type
 190                                           lsh-shepherd-service)
 191                        (service-extension pam-root-service-type
 192                                           lsh-pam-services)
 193                        (service-extension activation-service-type
 194                                           lsh-activation)))))
 195
 196 (define* (lsh-service #:key
 197                       (lsh lsh)
 198                       (daemonic? #t)
 199                       (host-key "/etc/lsh/host-key")
 200                       (interfaces '())
 201                       (port-number 22)
 202                       (allow-empty-passwords? #f)
 203                       (root-login? #f)
 204                       (syslog-output? #t)
 205                       (pid-file? #f)
 206                       (pid-file "/var/run/lshd.pid")
 207                       (x11-forwarding? #t)
 208                       (tcp/ip-forwarding? #t)
 209                       (password-authentication? #t)
 210                       (public-key-authentication? #t)
 211                       (initialize? #t))
 212   "Run the @command{lshd} program from @var{lsh} to listen on port @var{port-number}.
 213 @var{host-key} must designate a file containing the host key, and readable
 214 only by root.
 215
 216 When @var{daemonic?} is true, @command{lshd} will detach from the
 217 controlling terminal and log its output to syslogd, unless one sets
 218 @var{syslog-output?} to false.  Obviously, it also makes lsh-service
 219 depend on existence of syslogd service.  When @var{pid-file?} is true,
 220 @command{lshd} writes its PID to the file called @var{pid-file}.
 221
 222 When @var{initialize?} is true, automatically create the seed and host key
 223 upon service activation if they do not exist yet.  This may take long and
 224 require interaction.
 225
 226 When @var{initialize?} is false, it is up to the user to initialize the
 227 randomness generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to create
 228 a key pair with the private key stored in file @var{host-key} (@pxref{lshd
 229 basics,,, lsh, LSH Manual}).
 230
 231 When @var{interfaces} is empty, lshd listens for connections on all the
 232 network interfaces; otherwise, @var{interfaces} must be a list of host names
 233 or addresses.
 234
 235 @var{allow-empty-passwords?} specifies whether to accept log-ins with empty
 236 passwords, and @var{root-login?} specifies whether to accept log-ins as
 237 root.
 238
 239 The other options should be self-descriptive."
 240   (service lsh-service-type
 241            (lsh-configuration (lsh lsh) (daemonic? daemonic?)
 242                               (host-key host-key) (interfaces interfaces)
 243                               (port-number port-number)
 244                               (allow-empty-passwords? allow-empty-passwords?)
 245                               (root-login? root-login?)
 246                               (syslog-output? syslog-output?)
 247                               (pid-file? pid-file?) (pid-file pid-file)
 248                               (x11-forwarding? x11-forwarding?)
 249                               (tcp/ip-forwarding? tcp/ip-forwarding?)
 250                               (password-authentication?
 251                                password-authentication?)
 252                               (public-key-authentication?
 253                                public-key-authentication?)
 254                               (initialize? initialize?))))
 255
 256 \f
 257 ;;;
 258 ;;; OpenSSH.
 259 ;;;
 260
 261 (define-record-type* <openssh-configuration>
 262   openssh-configuration make-openssh-configuration
 263   openssh-configuration?
 264   ;; <package>
 265   (openssh               openssh-configuration-openssh
 266                          (default openssh))
 267   ;; string
 268   (pid-file              openssh-configuration-pid-file
 269                          (default "/var/run/sshd.pid"))
 270   ;; integer
 271   (port-number           openssh-configuration-port-number
 272                          (default 22))
 273   ;; Boolean | 'without-password
 274   (permit-root-login     openssh-configuration-permit-root-login
 275                          (default #f))
 276   ;; Boolean
 277   (allow-empty-passwords? openssh-configuration-allow-empty-passwords?
 278                           (default #f))
 279   ;; Boolean
 280   (password-authentication? openssh-configuration-password-authentication?
 281                             (default #t))
 282   ;; Boolean
 283   (public-key-authentication? openssh-configuration-public-key-authentication?
 284                               (default #t))
 285   ;; Boolean
 286   (x11-forwarding?       openssh-configuration-x11-forwarding?
 287                          (default #f))
 288   ;; Boolean
 289   (challenge-response-authentication? openssh-challenge-response-authentication?
 290                                       (default #f))
 291   ;; Boolean
 292   (use-pam?              openssh-configuration-use-pam?
 293                          (default #t))
 294   ;; Boolean
 295   (print-last-log?       openssh-configuration-print-last-log?
 296                          (default #t))
 297   ;; list of two-element lists
 298   (subsystems            openssh-configuration-subsystems
 299                          (default '(("sftp" "internal-sftp"))))
 300
 301   ;; list of user-name/file-like tuples
 302   (authorized-keys       openssh-authorized-keys
 303                          (default '())))
 304
 305 (define %openssh-accounts
 306   (list (user-group (name "sshd") (system? #t))
 307         (user-account
 308           (name "sshd")
 309           (group "sshd")
 310           (system? #t)
 311           (comment "sshd privilege separation user")
 312           (home-directory "/var/run/sshd")
 313           (shell #~(string-append #$shadow "/sbin/nologin")))))
 314
 315 (define (openssh-activation config)
 316   "Return the activation GEXP for CONFIG."
 317   (with-imported-modules '((guix build utils))
 318     #~(begin
 319         (use-modules (guix build utils))
 320
 321         (define (touch file-name)
 322           (call-with-output-file file-name (const #t)))
 323
 324         ;; Make sure /etc/ssh can be read by the 'sshd' user.
 325         (mkdir-p "/etc/ssh")
 326         (chmod "/etc/ssh" #o755)
 327         (mkdir-p (dirname #$(openssh-configuration-pid-file config)))
 328
 329         ;; 'sshd' complains if the authorized-key directory and its parents
 330         ;; are group-writable, which rules out /gnu/store.  Thus we copy the
 331         ;; authorized-key directory to /etc.
 332         (catch 'system-error
 333           (lambda ()
 334             (delete-file-recursively "/etc/authorized_keys.d"))
 335           (lambda args
 336             (unless (= ENOENT (system-error-errno args))
 337               (apply throw args))))
 338         (copy-recursively #$(authorized-key-directory
 339                              (openssh-authorized-keys config))
 340                           "/etc/ssh/authorized_keys.d")
 341
 342         (chmod "/etc/ssh/authorized_keys.d" #o555)
 343
 344         (let ((lastlog "/var/log/lastlog"))
 345           (when #$(openssh-configuration-print-last-log? config)
 346             (unless (file-exists? lastlog)
 347               (touch lastlog))))
 348
 349         ;; Generate missing host keys.
 350         (system* (string-append #$(openssh-configuration-openssh config)
 351                                 "/bin/ssh-keygen") "-A"))))
 352
 353 (define (authorized-key-directory keys)
 354   "Return a directory containing the authorized keys specified in KEYS, a list
 355 of user-name/file-like tuples."
 356   (define build
 357     (with-imported-modules (source-module-closure '((guix build utils)))
 358       #~(begin
 359           (use-modules (ice-9 match) (srfi srfi-26)
 360                        (guix build utils))
 361
 362           (mkdir #$output)
 363           (for-each (match-lambda
 364                       ((user keys ...)
 365                        (let ((file (string-append #$output "/" user)))
 366                          (call-with-output-file file
 367                            (lambda (port)
 368                              (for-each (lambda (key)
 369                                          (call-with-input-file key
 370                                            (cut dump-port <> port)))
 371                                        keys))))))
 372                     '#$keys))))
 373
 374   (computed-file "openssh-authorized-keys" build))
 375
 376 (define (openssh-config-file config)
 377   "Return the sshd configuration file corresponding to CONFIG."
 378   (computed-file
 379    "sshd_config"
 380    #~(begin
 381        (use-modules (ice-9 match))
 382        (call-with-output-file #$output
 383          (lambda (port)
 384            (display "# Generated by 'openssh-service'.\n" port)
 385            (format port "Port ~a\n"
 386                    #$(number->string
 387                       (openssh-configuration-port-number config)))
 388            (format port "PermitRootLogin ~a\n"
 389                    #$(match (openssh-configuration-permit-root-login config)
 390                        (#t "yes")
 391                        (#f "no")
 392                        ('without-password "without-password")))
 393            (format port "PermitEmptyPasswords ~a\n"
 394                    #$(if (openssh-configuration-allow-empty-passwords? config)
 395                          "yes" "no"))
 396            (format port "PasswordAuthentication ~a\n"
 397                    #$(if (openssh-configuration-password-authentication? config)
 398                          "yes" "no"))
 399            (format port "PubkeyAuthentication ~a\n"
 400                    #$(if (openssh-configuration-public-key-authentication?
 401                           config)
 402                          "yes" "no"))
 403            (format port "X11Forwarding ~a\n"
 404                    #$(if (openssh-configuration-x11-forwarding? config)
 405                          "yes" "no"))
 406            (format port "PidFile ~a\n"
 407                    #$(openssh-configuration-pid-file config))
 408            (format port "ChallengeResponseAuthentication ~a\n"
 409                    #$(if (openssh-challenge-response-authentication? config)
 410                          "yes" "no"))
 411            (format port "UsePAM ~a\n"
 412                    #$(if (openssh-configuration-use-pam? config)
 413                          "yes" "no"))
 414            (format port "PrintLastLog ~a\n"
 415                    #$(if (openssh-configuration-print-last-log? config)
 416                          "yes" "no"))
 417
 418            ;; Add '/etc/authorized_keys.d/%u', which we populate.
 419            (format port "AuthorizedKeysFile \
 420  .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u\n")
 421
 422            (for-each
 423             (match-lambda
 424               ((name command) (format port "Subsystem\t~a\t~a\n" name command)))
 425             '#$(openssh-configuration-subsystems config))
 426            #t)))))
 427
 428 (define (openssh-shepherd-service config)
 429   "Return a <shepherd-service> for openssh with CONFIG."
 430
 431   (define pid-file
 432     (openssh-configuration-pid-file config))
 433
 434   (define openssh-command
 435     #~(list (string-append #$(openssh-configuration-openssh config) "/sbin/sshd")
 436             "-D" "-f" #$(openssh-config-file config)))
 437
 438   (list (shepherd-service
 439          (documentation "OpenSSH server.")
 440          (requirement '(syslogd))
 441          (provision '(ssh-daemon))
 442          (start #~(make-forkexec-constructor #$openssh-command
 443                                              #:pid-file #$pid-file))
 444          (stop #~(make-kill-destructor)))))
 445
 446 (define (openssh-pam-services config)
 447   "Return a list of <pam-services> for sshd with CONFIG."
 448   (list (unix-pam-service
 449          "sshd"
 450          #:allow-empty-passwords?
 451          (openssh-configuration-allow-empty-passwords? config))))
 452
 453 (define openssh-service-type
 454   (service-type (name 'openssh)
 455                 (extensions
 456                  (list (service-extension shepherd-root-service-type
 457                                           openssh-shepherd-service)
 458                        (service-extension pam-root-service-type
 459                                           openssh-pam-services)
 460                        (service-extension activation-service-type
 461                                           openssh-activation)
 462                        (service-extension account-service-type
 463                                           (const %openssh-accounts))))
 464                 (default-value (openssh-configuration))))
 465
 466 \f
 467 ;;;
 468 ;;; Dropbear.
 469 ;;;
 470
 471 (define-record-type* <dropbear-configuration>
 472   dropbear-configuration make-dropbear-configuration
 473   dropbear-configuration?
 474   (dropbear               dropbear-configuration-dropbear
 475                           (default dropbear))
 476   (port-number            dropbear-configuration-port-number
 477                           (default 22))
 478   (syslog-output?         dropbear-configuration-syslog-output?
 479                           (default #t))
 480   (pid-file               dropbear-configuration-pid-file
 481                           (default "/var/run/dropbear.pid"))
 482   (root-login?            dropbear-configuration-root-login?
 483                           (default #f))
 484   (allow-empty-passwords? dropbear-configuration-allow-empty-passwords?
 485                           (default #f))
 486   (password-authentication? dropbear-configuration-password-authentication?
 487                             (default #t)))
 488
 489 (define (dropbear-activation config)
 490   "Return the activation gexp for CONFIG."
 491   #~(begin
 492       (use-modules (guix build utils))
 493       (mkdir-p "/etc/dropbear")))
 494
 495 (define (dropbear-shepherd-service config)
 496   "Return a <shepherd-service> for dropbear with CONFIG."
 497   (define dropbear
 498     (dropbear-configuration-dropbear config))
 499
 500   (define pid-file
 501     (dropbear-configuration-pid-file config))
 502
 503   (define dropbear-command
 504     #~(list (string-append #$dropbear "/sbin/dropbear")
 505
 506             ;; '-R' allows host keys to be automatically generated upon first
 507             ;; connection, at a time when /dev/urandom is more likely securely
 508             ;; seeded.
 509             "-F" "-R"
 510
 511             "-p" #$(number->string (dropbear-configuration-port-number config))
 512             "-P" #$pid-file
 513             #$@(if (dropbear-configuration-syslog-output? config) '() '("-E"))
 514             #$@(if (dropbear-configuration-root-login? config) '() '("-w"))
 515             #$@(if (dropbear-configuration-password-authentication? config)
 516                    '()
 517                    '("-s" "-g"))
 518             #$@(if (dropbear-configuration-allow-empty-passwords? config)
 519                    '("-B")
 520                    '())))
 521
 522   (define requires
 523     (if (dropbear-configuration-syslog-output? config)
 524         '(networking syslogd) '(networking)))
 525
 526   (list (shepherd-service
 527          (documentation "Dropbear SSH server.")
 528          (requirement requires)
 529          (provision '(ssh-daemon))
 530          (start #~(make-forkexec-constructor #$dropbear-command
 531                                              #:pid-file #$pid-file))
 532          (stop #~(make-kill-destructor)))))
 533
 534 (define dropbear-service-type
 535   (service-type (name 'dropbear)
 536                 (extensions
 537                  (list (service-extension shepherd-root-service-type
 538                                           dropbear-shepherd-service)
 539                        (service-extension activation-service-type
 540                                           dropbear-activation)))))
 541
 542 (define* (dropbear-service #:optional (config (dropbear-configuration)))
 543   "Run the @uref{https://matt.ucc.asn.au/dropbear/dropbear.html,Dropbear SSH
 544 daemon} with the given @var{config}, a @code{<dropbear-configuration>}
 545 object."
 546   (service dropbear-service-type config))
 547
 548 ;;; ssh.scm ends here