gnu/services/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2016 David Craven <david@craven.ch>
   4 ;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu services ssh)
  22   #:use-module (gnu packages ssh)
  23   #:use-module (gnu packages admin)
  24   #:use-module (gnu services)
  25   #:use-module (gnu services shepherd)
  26   #:use-module (gnu system pam)
  27   #:use-module (gnu system shadow)
  28   #:use-module (guix gexp)
  29   #:use-module (guix records)
  30   #:use-module (srfi srfi-26)
  31   #:use-module (ice-9 match)
  32   #:export (lsh-configuration
  33             lsh-configuration?
  34             lsh-service
  35             lsh-service-type
  36
  37             openssh-configuration
  38             openssh-configuration?
  39             openssh-service-type
  40             openssh-service
  41
  42             dropbear-configuration
  43             dropbear-configuration?
  44             dropbear-service-type
  45             dropbear-service))
  46
  47 ;;; Commentary:
  48 ;;;
  49 ;;; This module implements secure shell (SSH) services.
  50 ;;;
  51 ;;; Code:
  52
  53 ;; TODO: Export.
  54 (define-record-type* <lsh-configuration>
  55   lsh-configuration make-lsh-configuration
  56   lsh-configuration?
  57   (lsh lsh-configuration-lsh
  58        (default lsh))
  59   (daemonic? lsh-configuration-daemonic?)
  60   (host-key lsh-configuration-host-key)
  61   (interfaces lsh-configuration-interfaces)
  62   (port-number lsh-configuration-port-number)
  63   (allow-empty-passwords? lsh-configuration-allow-empty-passwords?)
  64   (root-login? lsh-configuration-root-login?)
  65   (syslog-output? lsh-configuration-syslog-output?)
  66   (pid-file? lsh-configuration-pid-file?)
  67   (pid-file lsh-configuration-pid-file)
  68   (x11-forwarding? lsh-configuration-x11-forwarding?)
  69   (tcp/ip-forwarding? lsh-configuration-tcp/ip-forwarding?)
  70   (password-authentication? lsh-configuration-password-authentication?)
  71   (public-key-authentication? lsh-configuration-public-key-authentication?)
  72   (initialize? lsh-configuration-initialize?))
  73
  74 (define %yarrow-seed
  75   "/var/spool/lsh/yarrow-seed-file")
  76
  77 (define (lsh-initialization lsh host-key)
  78   "Return the gexp to initialize the LSH service for HOST-KEY."
  79   #~(begin
  80       (unless (file-exists? #$%yarrow-seed)
  81         (system* (string-append #$lsh "/bin/lsh-make-seed")
  82                  "--sloppy" "-o" #$%yarrow-seed))
  83
  84       (unless (file-exists? #$host-key)
  85         (mkdir-p (dirname #$host-key))
  86         (format #t "creating SSH host key '~a'...~%" #$host-key)
  87
  88         ;; FIXME: We're just doing a simple pipeline, but 'system' cannot be
  89         ;; used yet because /bin/sh might be dangling; factorize this somehow.
  90         (let* ((in+out (pipe))
  91                (keygen (primitive-fork)))
  92           (case keygen
  93             ((0)
  94              (close-port (car in+out))
  95              (close-fdes 1)
  96              (dup2 (fileno (cdr in+out)) 1)
  97              (execl (string-append #$lsh "/bin/lsh-keygen")
  98                     "lsh-keygen" "--server"))
  99             (else
 100              (let ((write-key (primitive-fork)))
 101                (case write-key
 102                  ((0)
 103                   (close-port (cdr in+out))
 104                   (close-fdes 0)
 105                   (dup2 (fileno (car in+out)) 0)
 106                   (execl (string-append #$lsh "/bin/lsh-writekey")
 107                          "lsh-writekey" "--server" "-o" #$host-key))
 108                  (else
 109                   (close-port (car in+out))
 110                   (close-port (cdr in+out))
 111                   (waitpid keygen)
 112                   (waitpid write-key))))))))))
 113
 114 (define (lsh-activation config)
 115   "Return the activation gexp for CONFIG."
 116   #~(begin
 117       (use-modules (guix build utils))
 118       (mkdir-p "/var/spool/lsh")
 119       #$(if (lsh-configuration-initialize? config)
 120             (lsh-initialization (lsh-configuration-lsh config)
 121                                 (lsh-configuration-host-key config))
 122             #t)))
 123
 124 (define (lsh-shepherd-service config)
 125   "Return a <shepherd-service> for lsh with CONFIG."
 126   (define lsh (lsh-configuration-lsh config))
 127   (define pid-file (lsh-configuration-pid-file config))
 128   (define pid-file? (lsh-configuration-pid-file? config))
 129   (define daemonic? (lsh-configuration-daemonic? config))
 130   (define interfaces (lsh-configuration-interfaces config))
 131
 132   (define lsh-command
 133     (append
 134      (cons (file-append lsh "/sbin/lshd")
 135            (if daemonic?
 136                (let ((syslog (if (lsh-configuration-syslog-output? config)
 137                                  '()
 138                                  (list "--no-syslog"))))
 139                  (cons "--daemonic"
 140                        (if pid-file?
 141                            (cons #~(string-append "--pid-file=" #$pid-file)
 142                                  syslog)
 143                            (cons "--no-pid-file" syslog))))
 144                (if pid-file?
 145                    (list #~(string-append "--pid-file=" #$pid-file))
 146                    '())))
 147      (cons* #~(string-append "--host-key="
 148                              #$(lsh-configuration-host-key config))
 149             #~(string-append "--password-helper=" #$lsh "/sbin/lsh-pam-checkpw")
 150             #~(string-append "--subsystems=sftp=" #$lsh "/sbin/sftp-server")
 151             "-p" (number->string (lsh-configuration-port-number config))
 152             (if (lsh-configuration-password-authentication? config)
 153                 "--password" "--no-password")
 154             (if (lsh-configuration-public-key-authentication? config)
 155                 "--publickey" "--no-publickey")
 156             (if (lsh-configuration-root-login? config)
 157                 "--root-login" "--no-root-login")
 158             (if (lsh-configuration-x11-forwarding? config)
 159                 "--x11-forward" "--no-x11-forward")
 160             (if (lsh-configuration-tcp/ip-forwarding? config)
 161                 "--tcpip-forward" "--no-tcpip-forward")
 162             (if (null? interfaces)
 163                 '()
 164                 (map (cut string-append "--interface=" <>)
 165                      interfaces)))))
 166
 167   (define requires
 168     (if (and daemonic? (lsh-configuration-syslog-output? config))
 169         '(networking syslogd)
 170         '(networking)))
 171
 172   (list (shepherd-service
 173          (documentation "GNU lsh SSH server")
 174          (provision '(ssh-daemon))
 175          (requirement requires)
 176          (start #~(make-forkexec-constructor (list #$@lsh-command)))
 177          (stop  #~(make-kill-destructor)))))
 178
 179 (define (lsh-pam-services config)
 180   "Return a list of <pam-services> for lshd with CONFIG."
 181   (list (unix-pam-service
 182          "lshd"
 183          #:allow-empty-passwords?
 184          (lsh-configuration-allow-empty-passwords? config))))
 185
 186 (define lsh-service-type
 187   (service-type (name 'lsh)
 188                 (extensions
 189                  (list (service-extension shepherd-root-service-type
 190                                           lsh-shepherd-service)
 191                        (service-extension pam-root-service-type
 192                                           lsh-pam-services)
 193                        (service-extension activation-service-type
 194                                           lsh-activation)))))
 195
 196 (define* (lsh-service #:key
 197                       (lsh lsh)
 198                       (daemonic? #t)
 199                       (host-key "/etc/lsh/host-key")
 200                       (interfaces '())
 201                       (port-number 22)
 202                       (allow-empty-passwords? #f)
 203                       (root-login? #f)
 204                       (syslog-output? #t)
 205                       (pid-file? #f)
 206                       (pid-file "/var/run/lshd.pid")
 207                       (x11-forwarding? #t)
 208                       (tcp/ip-forwarding? #t)
 209                       (password-authentication? #t)
 210                       (public-key-authentication? #t)
 211                       (initialize? #t))
 212   "Run the @command{lshd} program from @var{lsh} to listen on port @var{port-number}.
 213 @var{host-key} must designate a file containing the host key, and readable
 214 only by root.
 215
 216 When @var{daemonic?} is true, @command{lshd} will detach from the
 217 controlling terminal and log its output to syslogd, unless one sets
 218 @var{syslog-output?} to false.  Obviously, it also makes lsh-service
 219 depend on existence of syslogd service.  When @var{pid-file?} is true,
 220 @command{lshd} writes its PID to the file called @var{pid-file}.
 221
 222 When @var{initialize?} is true, automatically create the seed and host key
 223 upon service activation if they do not exist yet.  This may take long and
 224 require interaction.
 225
 226 When @var{initialize?} is false, it is up to the user to initialize the
 227 randomness generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to create
 228 a key pair with the private key stored in file @var{host-key} (@pxref{lshd
 229 basics,,, lsh, LSH Manual}).
 230
 231 When @var{interfaces} is empty, lshd listens for connections on all the
 232 network interfaces; otherwise, @var{interfaces} must be a list of host names
 233 or addresses.
 234
 235 @var{allow-empty-passwords?} specifies whether to accept log-ins with empty
 236 passwords, and @var{root-login?} specifies whether to accept log-ins as
 237 root.
 238
 239 The other options should be self-descriptive."
 240   (service lsh-service-type
 241            (lsh-configuration (lsh lsh) (daemonic? daemonic?)
 242                               (host-key host-key) (interfaces interfaces)
 243                               (port-number port-number)
 244                               (allow-empty-passwords? allow-empty-passwords?)
 245                               (root-login? root-login?)
 246                               (syslog-output? syslog-output?)
 247                               (pid-file? pid-file?) (pid-file pid-file)
 248                               (x11-forwarding? x11-forwarding?)
 249                               (tcp/ip-forwarding? tcp/ip-forwarding?)
 250                               (password-authentication?
 251                                password-authentication?)
 252                               (public-key-authentication?
 253                                public-key-authentication?)
 254                               (initialize? initialize?))))
 255
 256 \f
 257 ;;;
 258 ;;; OpenSSH.
 259 ;;;
 260
 261 (define-record-type* <openssh-configuration>
 262   openssh-configuration make-openssh-configuration
 263   openssh-configuration?
 264   (pid-file              openssh-configuration-pid-file) ;string
 265   (port-number           openssh-configuration-port-number) ;integer
 266   (permit-root-login     openssh-configuration-permit-root-login) ;Boolean | 'without-password
 267   (allow-empty-passwords? openssh-configuration-allow-empty-passwords?) ;Boolean
 268   (password-authentication? openssh-configuration-password-authentication?) ;Boolean
 269   (pubkey-authentication? openssh-configuration-pubkey-authentication?) ;Boolean
 270   (rsa-authentication?   openssh-configuration-rsa-authentication?) ;Boolean
 271   (x11-forwarding?       openssh-configuration-x11-forwarding?) ;Boolean
 272   (protocol-number       openssh-configuration-protocol-number)) ;integer
 273
 274 (define %openssh-accounts
 275   (list (user-group (name "sshd") (system? #t))
 276         (user-account
 277           (name "sshd")
 278           (group "sshd")
 279           (system? #t)
 280           (comment "sshd privilege separation user")
 281           (home-directory "/var/run/sshd")
 282           (shell #~(string-append #$shadow "/sbin/nologin")))))
 283
 284 (define (openssh-activation config)
 285   "Return the activation GEXP for CONFIG."
 286   #~(begin
 287       (mkdir-p "/etc/ssh")
 288       (mkdir-p (dirname #$(openssh-configuration-pid-file config)))
 289
 290       ;; Generate missing host keys.
 291       (system* (string-append #$openssh "/bin/ssh-keygen") "-A")))
 292
 293 (define (openssh-config-file config)
 294   "Return the sshd configuration file corresponding to CONFIG."
 295   (computed-file
 296    "sshd_config"
 297    #~(call-with-output-file #$output
 298        (lambda (port)
 299          (display "# Generated by 'openssh-service'.\n" port)
 300          (format port "Protocol ~a\n"
 301                  #$(if (eq? (openssh-configuration-protocol-number config) 1)
 302                        "1" "2"))
 303          (format port "Port ~a\n"
 304                  #$(number->string (openssh-configuration-port-number config)))
 305          (format port "PermitRootLogin ~a\n"
 306                  #$(match (openssh-configuration-permit-root-login config)
 307                      (#t "yes")
 308                      (#f "no")
 309                      ('without-password "without-password")))
 310          (format port "PermitEmptyPasswords ~a\n"
 311                  #$(if (openssh-configuration-allow-empty-passwords? config)
 312                        "yes" "no"))
 313          (format port "PasswordAuthentication ~a\n"
 314                  #$(if (openssh-configuration-password-authentication? config)
 315                        "yes" "no"))
 316          (format port "PubkeyAuthentication ~a\n"
 317                  #$(if (openssh-configuration-pubkey-authentication? config)
 318                        "yes" "no"))
 319          (format port "RSAAuthentication ~a\n"
 320                  #$(if (openssh-configuration-rsa-authentication? config)
 321                        "yes" "no"))
 322          (format port "X11Forwarding ~a\n"
 323                  #$(if (openssh-configuration-x11-forwarding? config)
 324                        "yes" "no"))
 325          (format port "PidFile ~a\n"
 326                  #$(openssh-configuration-pid-file config))
 327          #t))))
 328
 329 (define (openssh-shepherd-service config)
 330   "Return a <shepherd-service> for openssh with CONFIG."
 331
 332   (define pid-file
 333     (openssh-configuration-pid-file config))
 334
 335   (define openssh-command
 336     #~(list (string-append #$openssh "/sbin/sshd")
 337             "-D" "-f" #$(openssh-config-file config)))
 338
 339   (list (shepherd-service
 340          (documentation "OpenSSH server.")
 341          (requirement '(networking syslogd))
 342          (provision '(ssh-daemon))
 343          (start #~(make-forkexec-constructor #$openssh-command
 344                                              #:pid-file #$pid-file))
 345          (stop #~(make-kill-destructor)))))
 346
 347 (define openssh-service-type
 348   (service-type (name 'openssh)
 349                 (extensions
 350                  (list (service-extension shepherd-root-service-type
 351                                           openssh-shepherd-service)
 352                        (service-extension activation-service-type
 353                                           openssh-activation)
 354                        (service-extension account-service-type
 355                                           (const %openssh-accounts))))))
 356
 357 (define* (openssh-service #:key
 358                           (pid-file "/var/run/sshd.pid")
 359                           (port-number 22)
 360                           (permit-root-login 'without-password)
 361                           (allow-empty-passwords? #f)
 362                           (password-authentication? #t)
 363                           (pubkey-authentication? #t)
 364                           (rsa-authentication? #t)
 365                           (x11-forwarding? #f)
 366                           (protocol-number 2))
 367   (service openssh-service-type (openssh-configuration
 368                                  (pid-file pid-file)
 369                                  (port-number port-number)
 370                                  (permit-root-login permit-root-login)
 371                                  (allow-empty-passwords? allow-empty-passwords?)
 372                                  (password-authentication? password-authentication?)
 373                                  (pubkey-authentication? pubkey-authentication?)
 374                                  (rsa-authentication? rsa-authentication?)
 375                                  (x11-forwarding? x11-forwarding?)
 376                                  (protocol-number protocol-number))))
 377
 378 \f
 379 ;;;
 380 ;;; Dropbear.
 381 ;;;
 382
 383 (define-record-type* <dropbear-configuration>
 384   dropbear-configuration make-dropbear-configuration
 385   dropbear-configuration?
 386   (dropbear               dropbear-configuration-dropbear
 387                           (default dropbear))
 388   (port-number            dropbear-configuration-port-number
 389                           (default 22))
 390   (syslog-output?         dropbear-configuration-syslog-output?
 391                           (default #t))
 392   (pid-file               dropbear-configuration-pid-file
 393                           (default "/var/run/dropbear.pid"))
 394   (root-login?            dropbear-configuration-root-login?
 395                           (default #f))
 396   (allow-empty-passwords? dropbear-configuration-allow-empty-passwords?
 397                           (default #f))
 398   (password-authentication? dropbear-configuration-password-authentication?
 399                             (default #t)))
 400
 401 (define (dropbear-activation config)
 402   "Return the activation gexp for CONFIG."
 403   #~(begin
 404       (mkdir-p "/etc/dropbear")))
 405
 406 (define (dropbear-shepherd-service config)
 407   "Return a <shepherd-service> for dropbear with CONFIG."
 408   (define dropbear
 409     (dropbear-configuration-dropbear config))
 410
 411   (define pid-file
 412     (dropbear-configuration-pid-file config))
 413
 414   (define dropbear-command
 415     #~(list (string-append #$dropbear "/sbin/dropbear")
 416
 417             ;; '-R' allows host keys to be automatically generated upon first
 418             ;; connection, at a time when /dev/urandom is more likely securely
 419             ;; seeded.
 420             "-F" "-R"
 421
 422             "-p" #$(number->string (dropbear-configuration-port-number config))
 423             "-P" #$pid-file
 424             #$@(if (dropbear-configuration-syslog-output? config) '() '("-E"))
 425             #$@(if (dropbear-configuration-root-login? config) '() '("-w"))
 426             #$@(if (dropbear-configuration-password-authentication? config)
 427                    '()
 428                    '("-s" "-g"))
 429             #$@(if (dropbear-configuration-allow-empty-passwords? config)
 430                    '("-B")
 431                    '())))
 432
 433   (define requires
 434     (if (dropbear-configuration-syslog-output? config)
 435         '(networking syslogd) '(networking)))
 436
 437   (list (shepherd-service
 438          (documentation "Dropbear SSH server.")
 439          (requirement requires)
 440          (provision '(ssh-daemon))
 441          (start #~(make-forkexec-constructor #$dropbear-command
 442                                              #:pid-file #$pid-file))
 443          (stop #~(make-kill-destructor)))))
 444
 445 (define dropbear-service-type
 446   (service-type (name 'dropbear)
 447                 (extensions
 448                  (list (service-extension shepherd-root-service-type
 449                                           dropbear-shepherd-service)
 450                        (service-extension activation-service-type
 451                                           dropbear-activation)))))
 452
 453 (define* (dropbear-service #:optional (config (dropbear-configuration)))
 454   "Run the @uref{https://matt.ucc.asn.au/dropbear/dropbear.html,Dropbear SSH
 455 daemon} with the given @var{config}, a @code{<dropbear-configuration>}
 456 object."
 457   (service dropbear-service-type config))
 458
 459 ;;; ssh.scm ends here