1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
3 ;;; Copyright © 2016 David Craven <david@craven.ch>
4 ;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
5 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
6 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
7 ;;; Copyright © 2020 pinoaffe <pinoaffe@airmail.cc>
8 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
10 ;;; This file is part of GNU Guix.
12 ;;; GNU Guix is free software; you can redistribute it and/or modify it
13 ;;; under the terms of the GNU General Public License as published by
14 ;;; the Free Software Foundation; either version 3 of the License, or (at
15 ;;; your option) any later version.
17 ;;; GNU Guix is distributed in the hope that it will be useful, but
18 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
19 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 ;;; GNU General Public License for more details.
22 ;;; You should have received a copy of the GNU General Public License
23 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
25 (define-module (gnu services ssh)
26 #:use-module (gnu packages ssh)
27 #:use-module (gnu packages admin)
28 #:use-module (gnu services)
29 #:use-module (gnu services shepherd)
30 #:use-module (gnu services web)
31 #:use-module (gnu system pam)
32 #:use-module (gnu system shadow)
33 #:use-module (guix gexp)
34 #:use-module (guix records)
35 #:use-module (guix modules)
36 #:use-module (srfi srfi-1)
37 #:use-module (srfi srfi-26)
38 #:use-module (ice-9 match)
39 #:export (lsh-configuration
45 openssh-configuration?
48 dropbear-configuration
49 dropbear-configuration?
54 autossh-configuration?
60 %webssh-configuration-nginx))
64 ;;; This module implements secure shell (SSH) services.
68 (define-record-type* <lsh-configuration>
69 lsh-configuration make-lsh-configuration
71 (lsh lsh-configuration-lsh
73 (daemonic? lsh-configuration-daemonic?)
74 (host-key lsh-configuration-host-key)
75 (interfaces lsh-configuration-interfaces)
76 (port-number lsh-configuration-port-number)
77 (allow-empty-passwords? lsh-configuration-allow-empty-passwords?)
78 (root-login? lsh-configuration-root-login?)
79 (syslog-output? lsh-configuration-syslog-output?)
80 (pid-file? lsh-configuration-pid-file?)
81 (pid-file lsh-configuration-pid-file)
82 (x11-forwarding? lsh-configuration-x11-forwarding?)
83 (tcp/ip-forwarding? lsh-configuration-tcp/ip-forwarding?)
84 (password-authentication? lsh-configuration-password-authentication?)
85 (public-key-authentication? lsh-configuration-public-key-authentication?)
86 (initialize? lsh-configuration-initialize?))
89 "/var/spool/lsh/yarrow-seed-file")
91 (define (lsh-initialization lsh host-key)
92 "Return the gexp to initialize the LSH service for HOST-KEY."
94 (unless (file-exists? #$%yarrow-seed)
95 (system* (string-append #$lsh "/bin/lsh-make-seed")
96 "--sloppy" "-o" #$%yarrow-seed))
98 (unless (file-exists? #$host-key)
99 (mkdir-p (dirname #$host-key))
100 (format #t "creating SSH host key '~a'...~%" #$host-key)
102 ;; FIXME: We're just doing a simple pipeline, but 'system' cannot be
103 ;; used yet because /bin/sh might be dangling; factorize this somehow.
104 (let* ((in+out (pipe))
105 (keygen (primitive-fork)))
108 (close-port (car in+out))
110 (dup2 (fileno (cdr in+out)) 1)
111 (execl (string-append #$lsh "/bin/lsh-keygen")
112 "lsh-keygen" "--server"))
114 (let ((write-key (primitive-fork)))
117 (close-port (cdr in+out))
119 (dup2 (fileno (car in+out)) 0)
120 (execl (string-append #$lsh "/bin/lsh-writekey")
121 "lsh-writekey" "--server" "-o" #$host-key))
123 (close-port (car in+out))
124 (close-port (cdr in+out))
126 (waitpid write-key))))))))))
128 (define (lsh-activation config)
129 "Return the activation gexp for CONFIG."
131 (use-modules (guix build utils))
132 (mkdir-p "/var/spool/lsh")
133 #$(if (lsh-configuration-initialize? config)
134 (lsh-initialization (lsh-configuration-lsh config)
135 (lsh-configuration-host-key config))
138 (define (lsh-shepherd-service config)
139 "Return a <shepherd-service> for lsh with CONFIG."
140 (define lsh (lsh-configuration-lsh config))
141 (define pid-file (lsh-configuration-pid-file config))
142 (define pid-file? (lsh-configuration-pid-file? config))
143 (define daemonic? (lsh-configuration-daemonic? config))
144 (define interfaces (lsh-configuration-interfaces config))
148 (cons (file-append lsh "/sbin/lshd")
150 (let ((syslog (if (lsh-configuration-syslog-output? config)
152 (list "--no-syslog"))))
155 (cons #~(string-append "--pid-file=" #$pid-file)
157 (cons "--no-pid-file" syslog))))
159 (list #~(string-append "--pid-file=" #$pid-file))
161 (cons* #~(string-append "--host-key="
162 #$(lsh-configuration-host-key config))
163 #~(string-append "--password-helper=" #$lsh "/sbin/lsh-pam-checkpw")
164 #~(string-append "--subsystems=sftp=" #$lsh "/sbin/sftp-server")
165 "-p" (number->string (lsh-configuration-port-number config))
166 (if (lsh-configuration-password-authentication? config)
167 "--password" "--no-password")
168 (if (lsh-configuration-public-key-authentication? config)
169 "--publickey" "--no-publickey")
170 (if (lsh-configuration-root-login? config)
171 "--root-login" "--no-root-login")
172 (if (lsh-configuration-x11-forwarding? config)
173 "--x11-forward" "--no-x11-forward")
174 (if (lsh-configuration-tcp/ip-forwarding? config)
175 "--tcpip-forward" "--no-tcpip-forward")
176 (if (null? interfaces)
178 (map (cut string-append "--interface=" <>)
182 (if (and daemonic? (lsh-configuration-syslog-output? config))
183 '(networking syslogd)
186 (list (shepherd-service
187 (documentation "GNU lsh SSH server")
188 (provision '(ssh-daemon ssh sshd))
189 (requirement requires)
190 (start #~(make-forkexec-constructor (list #$@lsh-command)))
191 (stop #~(make-kill-destructor)))))
193 (define (lsh-pam-services config)
194 "Return a list of <pam-services> for lshd with CONFIG."
195 (list (unix-pam-service
198 #:allow-empty-passwords?
199 (lsh-configuration-allow-empty-passwords? config))))
201 (define lsh-service-type
202 (service-type (name 'lsh)
204 "Run the GNU@tie{}lsh secure shell (SSH) daemon,
207 (list (service-extension shepherd-root-service-type
208 lsh-shepherd-service)
209 (service-extension pam-root-service-type
211 (service-extension activation-service-type
214 (define* (lsh-service #:key
217 (host-key "/etc/lsh/host-key")
220 (allow-empty-passwords? #f)
224 (pid-file "/var/run/lshd.pid")
226 (tcp/ip-forwarding? #t)
227 (password-authentication? #t)
228 (public-key-authentication? #t)
230 "Run the @command{lshd} program from @var{lsh} to listen on port @var{port-number}.
231 @var{host-key} must designate a file containing the host key, and readable
234 When @var{daemonic?} is true, @command{lshd} will detach from the
235 controlling terminal and log its output to syslogd, unless one sets
236 @var{syslog-output?} to false. Obviously, it also makes lsh-service
237 depend on existence of syslogd service. When @var{pid-file?} is true,
238 @command{lshd} writes its PID to the file called @var{pid-file}.
240 When @var{initialize?} is true, automatically create the seed and host key
241 upon service activation if they do not exist yet. This may take long and
244 When @var{initialize?} is false, it is up to the user to initialize the
245 randomness generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to create
246 a key pair with the private key stored in file @var{host-key} (@pxref{lshd
247 basics,,, lsh, LSH Manual}).
249 When @var{interfaces} is empty, lshd listens for connections on all the
250 network interfaces; otherwise, @var{interfaces} must be a list of host names
253 @var{allow-empty-passwords?} specifies whether to accept log-ins with empty
254 passwords, and @var{root-login?} specifies whether to accept log-ins as
257 The other options should be self-descriptive."
258 (service lsh-service-type
259 (lsh-configuration (lsh lsh) (daemonic? daemonic?)
260 (host-key host-key) (interfaces interfaces)
261 (port-number port-number)
262 (allow-empty-passwords? allow-empty-passwords?)
263 (root-login? root-login?)
264 (syslog-output? syslog-output?)
265 (pid-file? pid-file?) (pid-file pid-file)
266 (x11-forwarding? x11-forwarding?)
267 (tcp/ip-forwarding? tcp/ip-forwarding?)
268 (password-authentication?
269 password-authentication?)
270 (public-key-authentication?
271 public-key-authentication?)
272 (initialize? initialize?))))
279 (define-record-type* <openssh-configuration>
280 openssh-configuration make-openssh-configuration
281 openssh-configuration?
283 (openssh openssh-configuration-openssh
286 (pid-file openssh-configuration-pid-file
287 (default "/var/run/sshd.pid"))
289 (port-number openssh-configuration-port-number
291 ;; Boolean | 'without-password
292 (permit-root-login openssh-configuration-permit-root-login
295 (allow-empty-passwords? openssh-configuration-allow-empty-passwords?
298 (password-authentication? openssh-configuration-password-authentication?
301 (public-key-authentication? openssh-configuration-public-key-authentication?
304 (x11-forwarding? openssh-configuration-x11-forwarding?
308 (allow-agent-forwarding? openssh-configuration-allow-agent-forwarding?
312 (allow-tcp-forwarding? openssh-configuration-allow-tcp-forwarding?
316 (gateway-ports? openssh-configuration-gateway-ports?
320 (challenge-response-authentication? openssh-challenge-response-authentication?
323 (use-pam? openssh-configuration-use-pam?
326 (print-last-log? openssh-configuration-print-last-log?
328 ;; list of two-element lists
329 (subsystems openssh-configuration-subsystems
330 (default '(("sftp" "internal-sftp"))))
333 (accepted-environment openssh-configuration-accepted-environment
337 (log-level openssh-configuration-log-level
341 ;; This is an "escape hatch" to provide configuration that isn't yet
342 ;; supported by this configuration record.
343 (extra-content openssh-configuration-extra-content
346 ;; list of user-name/file-like tuples
347 (authorized-keys openssh-authorized-keys
351 ;; XXX: This should really be handled in an orthogonal way, for instance as
352 ;; proposed in <https://bugs.gnu.org/27155>. Keep it internal/undocumented
354 (%auto-start? openssh-auto-start?
357 (define %openssh-accounts
358 (list (user-group (name "sshd") (system? #t))
363 (comment "sshd privilege separation user")
364 (home-directory "/var/run/sshd")
365 (shell (file-append shadow "/sbin/nologin")))))
367 (define (openssh-activation config)
368 "Return the activation GEXP for CONFIG."
369 (with-imported-modules '((guix build utils))
371 (use-modules (guix build utils))
373 (define (touch file-name)
374 (call-with-output-file file-name (const #t)))
376 ;; Make sure /etc/ssh can be read by the 'sshd' user.
378 (chmod "/etc/ssh" #o755)
379 (mkdir-p (dirname #$(openssh-configuration-pid-file config)))
381 ;; 'sshd' complains if the authorized-key directory and its parents
382 ;; are group-writable, which rules out /gnu/store. Thus we copy the
383 ;; authorized-key directory to /etc.
386 (delete-file-recursively "/etc/authorized_keys.d"))
388 (unless (= ENOENT (system-error-errno args))
389 (apply throw args))))
390 (copy-recursively #$(authorized-key-directory
391 (openssh-authorized-keys config))
392 "/etc/ssh/authorized_keys.d")
394 (chmod "/etc/ssh/authorized_keys.d" #o555)
396 (let ((lastlog "/var/log/lastlog"))
397 (when #$(openssh-configuration-print-last-log? config)
398 (unless (file-exists? lastlog)
401 ;; Generate missing host keys.
402 (system* (string-append #$(openssh-configuration-openssh config)
403 "/bin/ssh-keygen") "-A"))))
405 (define (authorized-key-directory keys)
406 "Return a directory containing the authorized keys specified in KEYS, a list
407 of user-name/file-like tuples."
409 (with-imported-modules (source-module-closure '((guix build utils)))
411 (use-modules (ice-9 match) (srfi srfi-26)
415 (for-each (match-lambda
417 (let ((file (string-append #$output "/" user)))
418 (call-with-output-file file
420 (for-each (lambda (key)
421 (call-with-input-file key
422 (cut dump-port <> port)))
426 (computed-file "openssh-authorized-keys" build))
428 (define (openssh-config-file config)
429 "Return the sshd configuration file corresponding to CONFIG."
433 (use-modules (ice-9 match))
434 (call-with-output-file #$output
436 (display "# Generated by 'openssh-service'.\n" port)
437 (format port "Port ~a\n"
439 (openssh-configuration-port-number config)))
440 (format port "PermitRootLogin ~a\n"
441 #$(match (openssh-configuration-permit-root-login config)
444 ('without-password "without-password")))
445 (format port "PermitEmptyPasswords ~a\n"
446 #$(if (openssh-configuration-allow-empty-passwords? config)
448 (format port "PasswordAuthentication ~a\n"
449 #$(if (openssh-configuration-password-authentication? config)
451 (format port "PubkeyAuthentication ~a\n"
452 #$(if (openssh-configuration-public-key-authentication?
455 (format port "X11Forwarding ~a\n"
456 #$(if (openssh-configuration-x11-forwarding? config)
458 (format port "AllowAgentForwarding ~a\n"
459 #$(if (openssh-configuration-allow-agent-forwarding? config)
461 (format port "AllowTcpForwarding ~a\n"
462 #$(if (openssh-configuration-allow-tcp-forwarding? config)
464 (format port "GatewayPorts ~a\n"
465 #$(if (openssh-configuration-gateway-ports? config)
467 (format port "PidFile ~a\n"
468 #$(openssh-configuration-pid-file config))
469 (format port "ChallengeResponseAuthentication ~a\n"
470 #$(if (openssh-challenge-response-authentication? config)
472 (format port "UsePAM ~a\n"
473 #$(if (openssh-configuration-use-pam? config)
475 (format port "PrintLastLog ~a\n"
476 #$(if (openssh-configuration-print-last-log? config)
478 (format port "LogLevel ~a\n"
481 (openssh-configuration-log-level config))))
483 ;; Add '/etc/authorized_keys.d/%u', which we populate.
484 (format port "AuthorizedKeysFile \
485 .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u\n")
487 (for-each (lambda (s) (format port "AcceptEnv ~a\n" s))
488 '#$(openssh-configuration-accepted-environment config))
492 ((name command) (format port "Subsystem\t~a\t~a\n" name command)))
493 '#$(openssh-configuration-subsystems config))
496 #$(openssh-configuration-extra-content config))
499 (define (openssh-shepherd-service config)
500 "Return a <shepherd-service> for openssh with CONFIG."
503 (openssh-configuration-pid-file config))
505 (define openssh-command
506 #~(list (string-append #$(openssh-configuration-openssh config) "/sbin/sshd")
507 "-D" "-f" #$(openssh-config-file config)))
509 (list (shepherd-service
510 (documentation "OpenSSH server.")
511 (requirement '(syslogd loopback))
512 (provision '(ssh-daemon ssh sshd))
513 (start #~(make-forkexec-constructor #$openssh-command
514 #:pid-file #$pid-file))
515 (stop #~(make-kill-destructor))
516 (auto-start? (openssh-auto-start? config)))))
518 (define (openssh-pam-services config)
519 "Return a list of <pam-services> for sshd with CONFIG."
520 (list (unix-pam-service
523 #:allow-empty-passwords?
524 (openssh-configuration-allow-empty-passwords? config))))
526 (define (extend-openssh-authorized-keys config keys)
527 "Extend CONFIG with the extra authorized keys listed in KEYS."
528 (openssh-configuration
531 (append (openssh-authorized-keys config) keys))))
533 (define openssh-service-type
534 (service-type (name 'openssh)
536 "Run the OpenSSH secure shell (SSH) server, @command{sshd}.")
538 (list (service-extension shepherd-root-service-type
539 openssh-shepherd-service)
540 (service-extension pam-root-service-type
541 openssh-pam-services)
542 (service-extension activation-service-type
544 (service-extension account-service-type
545 (const %openssh-accounts))
547 ;; Install OpenSSH in the system profile. That way,
548 ;; 'scp' is found when someone tries to copy to or from
550 (service-extension profile-service-type
552 (list (openssh-configuration-openssh
554 (compose concatenate)
555 (extend extend-openssh-authorized-keys)
556 (default-value (openssh-configuration))))
563 (define-record-type* <dropbear-configuration>
564 dropbear-configuration make-dropbear-configuration
565 dropbear-configuration?
566 (dropbear dropbear-configuration-dropbear
568 (port-number dropbear-configuration-port-number
570 (syslog-output? dropbear-configuration-syslog-output?
572 (pid-file dropbear-configuration-pid-file
573 (default "/var/run/dropbear.pid"))
574 (root-login? dropbear-configuration-root-login?
576 (allow-empty-passwords? dropbear-configuration-allow-empty-passwords?
578 (password-authentication? dropbear-configuration-password-authentication?
581 (define (dropbear-activation config)
582 "Return the activation gexp for CONFIG."
584 (use-modules (guix build utils))
585 (mkdir-p "/etc/dropbear")))
587 (define (dropbear-shepherd-service config)
588 "Return a <shepherd-service> for dropbear with CONFIG."
590 (dropbear-configuration-dropbear config))
593 (dropbear-configuration-pid-file config))
595 (define dropbear-command
596 #~(list (string-append #$dropbear "/sbin/dropbear")
598 ;; '-R' allows host keys to be automatically generated upon first
599 ;; connection, at a time when /dev/urandom is more likely securely
603 "-p" #$(number->string (dropbear-configuration-port-number config))
605 #$@(if (dropbear-configuration-syslog-output? config) '() '("-E"))
606 #$@(if (dropbear-configuration-root-login? config) '() '("-w"))
607 #$@(if (dropbear-configuration-password-authentication? config)
610 #$@(if (dropbear-configuration-allow-empty-passwords? config)
615 (if (dropbear-configuration-syslog-output? config)
616 '(networking syslogd) '(networking)))
618 (list (shepherd-service
619 (documentation "Dropbear SSH server.")
620 (requirement requires)
621 (provision '(ssh-daemon ssh sshd))
622 (start #~(make-forkexec-constructor #$dropbear-command
623 #:pid-file #$pid-file))
624 (stop #~(make-kill-destructor)))))
626 (define dropbear-service-type
627 (service-type (name 'dropbear)
629 "Run the Dropbear secure shell (SSH) server.")
631 (list (service-extension shepherd-root-service-type
632 dropbear-shepherd-service)
633 (service-extension activation-service-type
634 dropbear-activation)))
635 (default-value (dropbear-configuration))))
637 (define* (dropbear-service #:optional (config (dropbear-configuration)))
638 "Run the @uref{https://matt.ucc.asn.au/dropbear/dropbear.html,Dropbear SSH
639 daemon} with the given @var{config}, a @code{<dropbear-configuration>}
641 (service dropbear-service-type config))
649 (define-record-type* <autossh-configuration>
650 autossh-configuration make-autossh-configuration
651 autossh-configuration?
652 (user autossh-configuration-user
654 (poll autossh-configuration-poll
656 (first-poll autossh-configuration-first-poll
658 (gate-time autossh-configuration-gate-time
660 (log-level autossh-configuration-log-level
662 (max-start autossh-configuration-max-start
664 (message autossh-configuration-message
666 (port autossh-configuration-port
668 (ssh-options autossh-configuration-ssh-options
671 (define (autossh-file-name config file)
672 "Return a path in /var/run/autossh/ that is writable
673 by @code{user} from @code{config}."
674 (string-append "/var/run/autossh/"
675 (autossh-configuration-user config)
678 (define (autossh-shepherd-service config)
680 (documentation "Automatically set up ssh connections (and keep them alive).")
681 (provision '(autossh))
682 (start #~(make-forkexec-constructor
683 (list #$(file-append autossh "/bin/autossh")
684 #$@(autossh-configuration-ssh-options config))
685 #:user #$(autossh-configuration-user config)
686 #:group (passwd:gid (getpw #$(autossh-configuration-user config)))
687 #:pid-file #$(autossh-file-name config "pid")
688 #:log-file #$(autossh-file-name config "log")
689 #:environment-variables
690 '(#$(string-append "AUTOSSH_PIDFILE="
691 (autossh-file-name config "pid"))
692 #$(string-append "AUTOSSH_LOGFILE="
693 (autossh-file-name config "log"))
694 #$(string-append "AUTOSSH_POLL="
696 (autossh-configuration-poll config)))
697 #$(string-append "AUTOSSH_FIRST_POLL="
700 (autossh-configuration-first-poll config)
701 (autossh-configuration-poll config))))
702 #$(string-append "AUTOSSH_GATETIME="
704 (autossh-configuration-gate-time config)))
705 #$(string-append "AUTOSSH_LOGLEVEL="
707 (autossh-configuration-log-level config)))
708 #$(string-append "AUTOSSH_MAXSTART="
710 (or (autossh-configuration-max-start config)
712 #$(string-append "AUTOSSH_MESSAGE="
713 (autossh-configuration-message config))
714 #$(string-append "AUTOSSH_PORT="
715 (autossh-configuration-port config)))))
716 (stop #~(make-kill-destructor))))
718 (define (autossh-service-activation config)
719 (with-imported-modules '((guix build utils))
721 (use-modules (guix build utils))
723 (getpw #$(autossh-configuration-user config)))
724 (let* ((directory #$(autossh-file-name config ""))
725 (log (string-append directory "/log")))
727 (chown directory (passwd:uid %user) (passwd:gid %user))
728 (call-with-output-file log (const #t))
729 (chown log (passwd:uid %user) (passwd:gid %user))))))
731 (define autossh-service-type
734 (description "Automatically set up ssh connections (and keep them alive).")
736 (list (service-extension shepherd-root-service-type
737 (compose list autossh-shepherd-service))
738 (service-extension activation-service-type
739 autossh-service-activation)))
740 (default-value (autossh-configuration))))
747 (define-record-type* <webssh-configuration>
748 webssh-configuration make-webssh-configuration
749 webssh-configuration?
750 (package webssh-configuration-package ;package
752 (user-name webssh-configuration-user-name ;string
754 (group-name webssh-configuration-group-name ;string
756 (policy webssh-configuration-policy ;symbol
758 (known-hosts webssh-configuration-known-hosts ;list of strings
760 (port webssh-configuration-port ;number
762 (address webssh-configuration-address ;string
764 (log-file webssh-configuration-log-file ;string
765 (default "/var/log/webssh.log"))
766 (log-level webssh-configuration-log-level ;symbol
769 (define %webssh-configuration-nginx
770 (nginx-server-configuration
773 (list (nginx-location-configuration
775 (body '("proxy_pass http://127.0.0.1:8888;"
776 "proxy_http_version 1.1;"
777 "proxy_read_timeout 300;"
778 "proxy_set_header Upgrade $http_upgrade;"
779 "proxy_set_header Connection \"upgrade\";"
780 "proxy_set_header Host $http_host;"
781 "proxy_set_header X-Real-IP $remote_addr;"
782 "proxy_set_header X-Real-PORT $remote_port;")))))))
784 (define webssh-account
785 ;; Return the user accounts and user groups for CONFIG.
787 (($ <webssh-configuration> _ user-name group-name _ _ _ _ _ _)
793 (comment "webssh privilege separation user")
794 (home-directory (string-append "/var/run/" user-name))
795 (shell #~(string-append #$shadow "/sbin/nologin")))))))
797 (define webssh-activation
798 ;; Return the activation GEXP for CONFIG.
800 (($ <webssh-configuration> _ user-name group-name policy known-hosts _ _
802 (with-imported-modules '((guix build utils))
804 (let* ((home-dir (string-append "/var/run/" #$user-name))
805 (ssh-dir (string-append home-dir "/.ssh"))
806 (known-hosts-file (string-append ssh-dir "/known_hosts")))
807 (call-with-output-file #$log-file (const #t))
812 (call-with-output-file known-hosts-file
814 (for-each (lambda (host) (display host port) (newline port))
816 (display-hint (G_ "webssh: reject policy requires `known-hosts'.")))))
817 (for-each (lambda (file)
819 (passwd:uid (getpw #$user-name))
820 (group:gid (getpw #$group-name))))
821 (list #$log-file ssh-dir known-hosts-file))
822 (chmod ssh-dir #o700)))))))
824 (define webssh-shepherd-service
826 (($ <webssh-configuration> package user-name group-name policy _ port
827 address log-file log-level)
828 (list (shepherd-service
829 (provision '(webssh))
830 (documentation "Run webssh daemon.")
831 (start #~(make-forkexec-constructor
832 `(,(string-append #$webssh "/bin/wssh")
833 ,(string-append "--log-file-prefix=" #$log-file)
835 ((debug) '("--logging=debug"))
838 ((reject) '("--policy=reject"))
841 (list (string-append "--port=" (number->string #$port)))
844 (list (string-append "--address=" #$address))
847 #:group #$group-name))
848 (stop #~(make-kill-destructor)))))))
850 (define webssh-service-type
854 (list (service-extension shepherd-root-service-type
855 webssh-shepherd-service)
856 (service-extension account-service-type
858 (service-extension activation-service-type
860 (default-value (webssh-configuration))
864 ;;; ssh.scm ends here