1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
3 ;;; Copyright © 2016 David Craven <david@craven.ch>
4 ;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
5 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
6 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
7 ;;; Copyright © 2020 pinoaffe <pinoaffe@airmail.cc>
8 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
10 ;;; This file is part of GNU Guix.
12 ;;; GNU Guix is free software; you can redistribute it and/or modify it
13 ;;; under the terms of the GNU General Public License as published by
14 ;;; the Free Software Foundation; either version 3 of the License, or (at
15 ;;; your option) any later version.
17 ;;; GNU Guix is distributed in the hope that it will be useful, but
18 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
19 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 ;;; GNU General Public License for more details.
22 ;;; You should have received a copy of the GNU General Public License
23 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
25 (define-module (gnu services ssh)
26 #:use-module (gnu packages ssh)
27 #:use-module (gnu packages admin)
28 #:use-module (gnu services)
29 #:use-module (gnu services shepherd)
30 #:use-module (gnu services web)
31 #:use-module (gnu system pam)
32 #:use-module (gnu system shadow)
33 #:use-module (guix gexp)
34 #:use-module (guix records)
35 #:use-module (guix modules)
36 #:use-module ((guix i18n) #:select (G_))
37 #:use-module ((guix diagnostics) #:select (warning source-properties->location))
38 #:use-module ((guix memoization) #:select (mlambda))
39 #:use-module (srfi srfi-1)
40 #:use-module (srfi srfi-26)
41 #:use-module (ice-9 match)
42 #:export (lsh-configuration
48 openssh-configuration?
51 dropbear-configuration
52 dropbear-configuration?
57 autossh-configuration?
63 %webssh-configuration-nginx))
67 ;;; This module implements secure shell (SSH) services.
71 (define-record-type* <lsh-configuration>
72 lsh-configuration make-lsh-configuration
74 (lsh lsh-configuration-lsh
76 (daemonic? lsh-configuration-daemonic?)
77 (host-key lsh-configuration-host-key)
78 (interfaces lsh-configuration-interfaces)
79 (port-number lsh-configuration-port-number)
80 (allow-empty-passwords? lsh-configuration-allow-empty-passwords?)
81 (root-login? lsh-configuration-root-login?)
82 (syslog-output? lsh-configuration-syslog-output?)
83 (pid-file? lsh-configuration-pid-file?)
84 (pid-file lsh-configuration-pid-file)
85 (x11-forwarding? lsh-configuration-x11-forwarding?)
86 (tcp/ip-forwarding? lsh-configuration-tcp/ip-forwarding?)
87 (password-authentication? lsh-configuration-password-authentication?)
88 (public-key-authentication? lsh-configuration-public-key-authentication?)
89 (initialize? lsh-configuration-initialize?))
92 "/var/spool/lsh/yarrow-seed-file")
94 (define (lsh-initialization lsh host-key)
95 "Return the gexp to initialize the LSH service for HOST-KEY."
97 (unless (file-exists? #$%yarrow-seed)
98 (system* (string-append #$lsh "/bin/lsh-make-seed")
99 "--sloppy" "-o" #$%yarrow-seed))
101 (unless (file-exists? #$host-key)
102 (mkdir-p (dirname #$host-key))
103 (format #t "creating SSH host key '~a'...~%" #$host-key)
105 ;; FIXME: We're just doing a simple pipeline, but 'system' cannot be
106 ;; used yet because /bin/sh might be dangling; factorize this somehow.
107 (let* ((in+out (pipe))
108 (keygen (primitive-fork)))
111 (close-port (car in+out))
113 (dup2 (fileno (cdr in+out)) 1)
114 (execl (string-append #$lsh "/bin/lsh-keygen")
115 "lsh-keygen" "--server"))
117 (let ((write-key (primitive-fork)))
120 (close-port (cdr in+out))
122 (dup2 (fileno (car in+out)) 0)
123 (execl (string-append #$lsh "/bin/lsh-writekey")
124 "lsh-writekey" "--server" "-o" #$host-key))
126 (close-port (car in+out))
127 (close-port (cdr in+out))
129 (waitpid write-key))))))))))
131 (define (lsh-activation config)
132 "Return the activation gexp for CONFIG."
134 (use-modules (guix build utils))
135 (mkdir-p "/var/spool/lsh")
136 #$(if (lsh-configuration-initialize? config)
137 (lsh-initialization (lsh-configuration-lsh config)
138 (lsh-configuration-host-key config))
141 (define (lsh-shepherd-service config)
142 "Return a <shepherd-service> for lsh with CONFIG."
143 (define lsh (lsh-configuration-lsh config))
144 (define pid-file (lsh-configuration-pid-file config))
145 (define pid-file? (lsh-configuration-pid-file? config))
146 (define daemonic? (lsh-configuration-daemonic? config))
147 (define interfaces (lsh-configuration-interfaces config))
151 (cons (file-append lsh "/sbin/lshd")
153 (let ((syslog (if (lsh-configuration-syslog-output? config)
155 (list "--no-syslog"))))
158 (cons #~(string-append "--pid-file=" #$pid-file)
160 (cons "--no-pid-file" syslog))))
162 (list #~(string-append "--pid-file=" #$pid-file))
164 (cons* #~(string-append "--host-key="
165 #$(lsh-configuration-host-key config))
166 #~(string-append "--password-helper=" #$lsh "/sbin/lsh-pam-checkpw")
167 #~(string-append "--subsystems=sftp=" #$lsh "/sbin/sftp-server")
168 "-p" (number->string (lsh-configuration-port-number config))
169 (if (lsh-configuration-password-authentication? config)
170 "--password" "--no-password")
171 (if (lsh-configuration-public-key-authentication? config)
172 "--publickey" "--no-publickey")
173 (if (lsh-configuration-root-login? config)
174 "--root-login" "--no-root-login")
175 (if (lsh-configuration-x11-forwarding? config)
176 "--x11-forward" "--no-x11-forward")
177 (if (lsh-configuration-tcp/ip-forwarding? config)
178 "--tcpip-forward" "--no-tcpip-forward")
179 (if (null? interfaces)
181 (map (cut string-append "--interface=" <>)
185 (if (and daemonic? (lsh-configuration-syslog-output? config))
186 '(networking syslogd)
189 (list (shepherd-service
190 (documentation "GNU lsh SSH server")
191 (provision '(ssh-daemon ssh sshd))
192 (requirement requires)
193 (start #~(make-forkexec-constructor (list #$@lsh-command)))
194 (stop #~(make-kill-destructor)))))
196 (define (lsh-pam-services config)
197 "Return a list of <pam-services> for lshd with CONFIG."
198 (list (unix-pam-service
201 #:allow-empty-passwords?
202 (lsh-configuration-allow-empty-passwords? config))))
204 (define lsh-service-type
205 (service-type (name 'lsh)
207 "Run the GNU@tie{}lsh secure shell (SSH) daemon,
210 (list (service-extension shepherd-root-service-type
211 lsh-shepherd-service)
212 (service-extension pam-root-service-type
214 (service-extension activation-service-type
217 (define* (lsh-service #:key
220 (host-key "/etc/lsh/host-key")
223 (allow-empty-passwords? #f)
227 (pid-file "/var/run/lshd.pid")
229 (tcp/ip-forwarding? #t)
230 (password-authentication? #t)
231 (public-key-authentication? #t)
233 "Run the @command{lshd} program from @var{lsh} to listen on port @var{port-number}.
234 @var{host-key} must designate a file containing the host key, and readable
237 When @var{daemonic?} is true, @command{lshd} will detach from the
238 controlling terminal and log its output to syslogd, unless one sets
239 @var{syslog-output?} to false. Obviously, it also makes lsh-service
240 depend on existence of syslogd service. When @var{pid-file?} is true,
241 @command{lshd} writes its PID to the file called @var{pid-file}.
243 When @var{initialize?} is true, automatically create the seed and host key
244 upon service activation if they do not exist yet. This may take long and
247 When @var{initialize?} is false, it is up to the user to initialize the
248 randomness generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to create
249 a key pair with the private key stored in file @var{host-key} (@pxref{lshd
250 basics,,, lsh, LSH Manual}).
252 When @var{interfaces} is empty, lshd listens for connections on all the
253 network interfaces; otherwise, @var{interfaces} must be a list of host names
256 @var{allow-empty-passwords?} specifies whether to accept log-ins with empty
257 passwords, and @var{root-login?} specifies whether to accept log-ins as
260 The other options should be self-descriptive."
261 (service lsh-service-type
262 (lsh-configuration (lsh lsh) (daemonic? daemonic?)
263 (host-key host-key) (interfaces interfaces)
264 (port-number port-number)
265 (allow-empty-passwords? allow-empty-passwords?)
266 (root-login? root-login?)
267 (syslog-output? syslog-output?)
268 (pid-file? pid-file?) (pid-file pid-file)
269 (x11-forwarding? x11-forwarding?)
270 (tcp/ip-forwarding? tcp/ip-forwarding?)
271 (password-authentication?
272 password-authentication?)
273 (public-key-authentication?
274 public-key-authentication?)
275 (initialize? initialize?))))
282 (define true-but-soon-false
284 ;; The plan is to change the default 'password-authentication?' to #f in
285 ;; Guix 1.3.0 or so. See <https://issues.guix.gnu.org/44808>.
286 (warning (source-properties->location loc)
287 (G_ "The default value of the 'password-authentication?'
288 field of 'openssh-configuration' will change from #true to #false in the
289 future. Explicitly set it to #true to allow password authentication.~%"))
292 (define-record-type* <openssh-configuration>
293 openssh-configuration make-openssh-configuration
294 openssh-configuration?
296 (openssh openssh-configuration-openssh
299 (pid-file openssh-configuration-pid-file
300 (default "/var/run/sshd.pid"))
302 (port-number openssh-configuration-port-number
304 ;; Boolean | 'without-password
305 (permit-root-login openssh-configuration-permit-root-login
308 (allow-empty-passwords? openssh-configuration-allow-empty-passwords?
311 (password-authentication? openssh-configuration-password-authentication?
312 (default (true-but-soon-false
313 (current-source-location))))
315 (public-key-authentication? openssh-configuration-public-key-authentication?
318 (x11-forwarding? openssh-configuration-x11-forwarding?
322 (allow-agent-forwarding? openssh-configuration-allow-agent-forwarding?
326 (allow-tcp-forwarding? openssh-configuration-allow-tcp-forwarding?
330 (gateway-ports? openssh-configuration-gateway-ports?
334 (challenge-response-authentication? openssh-challenge-response-authentication?
337 (use-pam? openssh-configuration-use-pam?
340 (print-last-log? openssh-configuration-print-last-log?
342 ;; list of two-element lists
343 (subsystems openssh-configuration-subsystems
344 (default '(("sftp" "internal-sftp"))))
347 (accepted-environment openssh-configuration-accepted-environment
351 (log-level openssh-configuration-log-level
355 ;; This is an "escape hatch" to provide configuration that isn't yet
356 ;; supported by this configuration record.
357 (extra-content openssh-configuration-extra-content
360 ;; list of user-name/file-like tuples
361 (authorized-keys openssh-authorized-keys
365 ;; XXX: This should really be handled in an orthogonal way, for instance as
366 ;; proposed in <https://bugs.gnu.org/27155>. Keep it internal/undocumented
368 (%auto-start? openssh-auto-start?
371 (define %openssh-accounts
372 (list (user-group (name "sshd") (system? #t))
377 (comment "sshd privilege separation user")
378 (home-directory "/var/run/sshd")
379 (shell (file-append shadow "/sbin/nologin")))))
381 (define (openssh-activation config)
382 "Return the activation GEXP for CONFIG."
383 (with-imported-modules '((guix build utils))
385 (use-modules (guix build utils))
387 (define (touch file-name)
388 (call-with-output-file file-name (const #t)))
390 ;; Make sure /etc/ssh can be read by the 'sshd' user.
392 (chmod "/etc/ssh" #o755)
393 (mkdir-p (dirname #$(openssh-configuration-pid-file config)))
395 ;; 'sshd' complains if the authorized-key directory and its parents
396 ;; are group-writable, which rules out /gnu/store. Thus we copy the
397 ;; authorized-key directory to /etc.
400 (delete-file-recursively "/etc/authorized_keys.d"))
402 (unless (= ENOENT (system-error-errno args))
403 (apply throw args))))
404 (copy-recursively #$(authorized-key-directory
405 (openssh-authorized-keys config))
406 "/etc/ssh/authorized_keys.d")
408 (chmod "/etc/ssh/authorized_keys.d" #o555)
410 (let ((lastlog "/var/log/lastlog"))
411 (when #$(openssh-configuration-print-last-log? config)
412 (unless (file-exists? lastlog)
415 ;; Generate missing host keys.
416 (system* (string-append #$(openssh-configuration-openssh config)
417 "/bin/ssh-keygen") "-A"))))
419 (define (authorized-key-directory keys)
420 "Return a directory containing the authorized keys specified in KEYS, a list
421 of user-name/file-like tuples."
423 (with-imported-modules (source-module-closure '((guix build utils)))
425 (use-modules (ice-9 match) (srfi srfi-26)
429 (for-each (match-lambda
431 (let ((file (string-append #$output "/" user)))
432 (call-with-output-file file
434 (for-each (lambda (key)
435 (call-with-input-file key
436 (cut dump-port <> port)))
440 (computed-file "openssh-authorized-keys" build))
442 (define (openssh-config-file config)
443 "Return the sshd configuration file corresponding to CONFIG."
447 (use-modules (ice-9 match))
448 (call-with-output-file #$output
450 (display "# Generated by 'openssh-service'.\n" port)
451 (format port "Port ~a\n"
453 (openssh-configuration-port-number config)))
454 (format port "PermitRootLogin ~a\n"
455 #$(match (openssh-configuration-permit-root-login config)
458 ('without-password "without-password")))
459 (format port "PermitEmptyPasswords ~a\n"
460 #$(if (openssh-configuration-allow-empty-passwords? config)
462 (format port "PasswordAuthentication ~a\n"
463 #$(if (openssh-configuration-password-authentication? config)
465 (format port "PubkeyAuthentication ~a\n"
466 #$(if (openssh-configuration-public-key-authentication?
469 (format port "X11Forwarding ~a\n"
470 #$(if (openssh-configuration-x11-forwarding? config)
472 (format port "AllowAgentForwarding ~a\n"
473 #$(if (openssh-configuration-allow-agent-forwarding? config)
475 (format port "AllowTcpForwarding ~a\n"
476 #$(if (openssh-configuration-allow-tcp-forwarding? config)
478 (format port "GatewayPorts ~a\n"
479 #$(if (openssh-configuration-gateway-ports? config)
481 (format port "PidFile ~a\n"
482 #$(openssh-configuration-pid-file config))
483 (format port "ChallengeResponseAuthentication ~a\n"
484 #$(if (openssh-challenge-response-authentication? config)
486 (format port "UsePAM ~a\n"
487 #$(if (openssh-configuration-use-pam? config)
489 (format port "PrintLastLog ~a\n"
490 #$(if (openssh-configuration-print-last-log? config)
492 (format port "LogLevel ~a\n"
495 (openssh-configuration-log-level config))))
497 ;; Add '/etc/authorized_keys.d/%u', which we populate.
498 (format port "AuthorizedKeysFile \
499 .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u\n")
501 (for-each (lambda (s) (format port "AcceptEnv ~a\n" s))
502 '#$(openssh-configuration-accepted-environment config))
506 ((name command) (format port "Subsystem\t~a\t~a\n" name command)))
507 '#$(openssh-configuration-subsystems config))
510 #$(openssh-configuration-extra-content config))
513 (define (openssh-shepherd-service config)
514 "Return a <shepherd-service> for openssh with CONFIG."
517 (openssh-configuration-pid-file config))
519 (define openssh-command
520 #~(list (string-append #$(openssh-configuration-openssh config) "/sbin/sshd")
521 "-D" "-f" #$(openssh-config-file config)))
523 (list (shepherd-service
524 (documentation "OpenSSH server.")
525 (requirement '(syslogd loopback))
526 (provision '(ssh-daemon ssh sshd))
527 (start #~(make-forkexec-constructor #$openssh-command
528 #:pid-file #$pid-file))
529 (stop #~(make-kill-destructor))
530 (auto-start? (openssh-auto-start? config)))))
532 (define (openssh-pam-services config)
533 "Return a list of <pam-services> for sshd with CONFIG."
534 (list (unix-pam-service
537 #:allow-empty-passwords?
538 (openssh-configuration-allow-empty-passwords? config))))
540 (define (extend-openssh-authorized-keys config keys)
541 "Extend CONFIG with the extra authorized keys listed in KEYS."
542 (openssh-configuration
545 (append (openssh-authorized-keys config) keys))))
547 (define openssh-service-type
548 (service-type (name 'openssh)
550 "Run the OpenSSH secure shell (SSH) server, @command{sshd}.")
552 (list (service-extension shepherd-root-service-type
553 openssh-shepherd-service)
554 (service-extension pam-root-service-type
555 openssh-pam-services)
556 (service-extension activation-service-type
558 (service-extension account-service-type
559 (const %openssh-accounts))
561 ;; Install OpenSSH in the system profile. That way,
562 ;; 'scp' is found when someone tries to copy to or from
564 (service-extension profile-service-type
566 (list (openssh-configuration-openssh
568 (compose concatenate)
569 (extend extend-openssh-authorized-keys)
570 (default-value (openssh-configuration))))
577 (define-record-type* <dropbear-configuration>
578 dropbear-configuration make-dropbear-configuration
579 dropbear-configuration?
580 (dropbear dropbear-configuration-dropbear
582 (port-number dropbear-configuration-port-number
584 (syslog-output? dropbear-configuration-syslog-output?
586 (pid-file dropbear-configuration-pid-file
587 (default "/var/run/dropbear.pid"))
588 (root-login? dropbear-configuration-root-login?
590 (allow-empty-passwords? dropbear-configuration-allow-empty-passwords?
592 (password-authentication? dropbear-configuration-password-authentication?
595 (define (dropbear-activation config)
596 "Return the activation gexp for CONFIG."
598 (use-modules (guix build utils))
599 (mkdir-p "/etc/dropbear")))
601 (define (dropbear-shepherd-service config)
602 "Return a <shepherd-service> for dropbear with CONFIG."
604 (dropbear-configuration-dropbear config))
607 (dropbear-configuration-pid-file config))
609 (define dropbear-command
610 #~(list (string-append #$dropbear "/sbin/dropbear")
612 ;; '-R' allows host keys to be automatically generated upon first
613 ;; connection, at a time when /dev/urandom is more likely securely
617 "-p" #$(number->string (dropbear-configuration-port-number config))
619 #$@(if (dropbear-configuration-syslog-output? config) '() '("-E"))
620 #$@(if (dropbear-configuration-root-login? config) '() '("-w"))
621 #$@(if (dropbear-configuration-password-authentication? config)
624 #$@(if (dropbear-configuration-allow-empty-passwords? config)
629 (if (dropbear-configuration-syslog-output? config)
630 '(networking syslogd) '(networking)))
632 (list (shepherd-service
633 (documentation "Dropbear SSH server.")
634 (requirement requires)
635 (provision '(ssh-daemon ssh sshd))
636 (start #~(make-forkexec-constructor #$dropbear-command
637 #:pid-file #$pid-file))
638 (stop #~(make-kill-destructor)))))
640 (define dropbear-service-type
641 (service-type (name 'dropbear)
643 "Run the Dropbear secure shell (SSH) server.")
645 (list (service-extension shepherd-root-service-type
646 dropbear-shepherd-service)
647 (service-extension activation-service-type
648 dropbear-activation)))
649 (default-value (dropbear-configuration))))
651 (define* (dropbear-service #:optional (config (dropbear-configuration)))
652 "Run the @uref{https://matt.ucc.asn.au/dropbear/dropbear.html,Dropbear SSH
653 daemon} with the given @var{config}, a @code{<dropbear-configuration>}
655 (service dropbear-service-type config))
663 (define-record-type* <autossh-configuration>
664 autossh-configuration make-autossh-configuration
665 autossh-configuration?
666 (user autossh-configuration-user
668 (poll autossh-configuration-poll
670 (first-poll autossh-configuration-first-poll
672 (gate-time autossh-configuration-gate-time
674 (log-level autossh-configuration-log-level
676 (max-start autossh-configuration-max-start
678 (message autossh-configuration-message
680 (port autossh-configuration-port
682 (ssh-options autossh-configuration-ssh-options
685 (define (autossh-file-name config file)
686 "Return a path in /var/run/autossh/ that is writable
687 by @code{user} from @code{config}."
688 (string-append "/var/run/autossh/"
689 (autossh-configuration-user config)
692 (define (autossh-shepherd-service config)
694 (documentation "Automatically set up ssh connections (and keep them alive).")
695 (provision '(autossh))
696 (start #~(make-forkexec-constructor
697 (list #$(file-append autossh "/bin/autossh")
698 #$@(autossh-configuration-ssh-options config))
699 #:user #$(autossh-configuration-user config)
700 #:group (passwd:gid (getpw #$(autossh-configuration-user config)))
701 #:pid-file #$(autossh-file-name config "pid")
702 #:log-file #$(autossh-file-name config "log")
703 #:environment-variables
704 '(#$(string-append "AUTOSSH_PIDFILE="
705 (autossh-file-name config "pid"))
706 #$(string-append "AUTOSSH_LOGFILE="
707 (autossh-file-name config "log"))
708 #$(string-append "AUTOSSH_POLL="
710 (autossh-configuration-poll config)))
711 #$(string-append "AUTOSSH_FIRST_POLL="
714 (autossh-configuration-first-poll config)
715 (autossh-configuration-poll config))))
716 #$(string-append "AUTOSSH_GATETIME="
718 (autossh-configuration-gate-time config)))
719 #$(string-append "AUTOSSH_LOGLEVEL="
721 (autossh-configuration-log-level config)))
722 #$(string-append "AUTOSSH_MAXSTART="
724 (or (autossh-configuration-max-start config)
726 #$(string-append "AUTOSSH_MESSAGE="
727 (autossh-configuration-message config))
728 #$(string-append "AUTOSSH_PORT="
729 (autossh-configuration-port config)))))
730 (stop #~(make-kill-destructor))))
732 (define (autossh-service-activation config)
733 (with-imported-modules '((guix build utils))
735 (use-modules (guix build utils))
737 (getpw #$(autossh-configuration-user config)))
738 (let* ((directory #$(autossh-file-name config ""))
739 (log (string-append directory "/log")))
741 (chown directory (passwd:uid %user) (passwd:gid %user))
742 (call-with-output-file log (const #t))
743 (chown log (passwd:uid %user) (passwd:gid %user))))))
745 (define autossh-service-type
748 (description "Automatically set up ssh connections (and keep them alive).")
750 (list (service-extension shepherd-root-service-type
751 (compose list autossh-shepherd-service))
752 (service-extension activation-service-type
753 autossh-service-activation)))
754 (default-value (autossh-configuration))))
761 (define-record-type* <webssh-configuration>
762 webssh-configuration make-webssh-configuration
763 webssh-configuration?
764 (package webssh-configuration-package ;package
766 (user-name webssh-configuration-user-name ;string
768 (group-name webssh-configuration-group-name ;string
770 (policy webssh-configuration-policy ;symbol
772 (known-hosts webssh-configuration-known-hosts ;list of strings
774 (port webssh-configuration-port ;number
776 (address webssh-configuration-address ;string
778 (log-file webssh-configuration-log-file ;string
779 (default "/var/log/webssh.log"))
780 (log-level webssh-configuration-log-level ;symbol
783 (define %webssh-configuration-nginx
784 (nginx-server-configuration
787 (list (nginx-location-configuration
789 (body '("proxy_pass http://127.0.0.1:8888;"
790 "proxy_http_version 1.1;"
791 "proxy_read_timeout 300;"
792 "proxy_set_header Upgrade $http_upgrade;"
793 "proxy_set_header Connection \"upgrade\";"
794 "proxy_set_header Host $http_host;"
795 "proxy_set_header X-Real-IP $remote_addr;"
796 "proxy_set_header X-Real-PORT $remote_port;")))))))
798 (define webssh-account
799 ;; Return the user accounts and user groups for CONFIG.
801 (($ <webssh-configuration> _ user-name group-name _ _ _ _ _ _)
807 (comment "webssh privilege separation user")
808 (home-directory (string-append "/var/run/" user-name))
809 (shell #~(string-append #$shadow "/sbin/nologin")))))))
811 (define webssh-activation
812 ;; Return the activation GEXP for CONFIG.
814 (($ <webssh-configuration> _ user-name group-name policy known-hosts _ _
816 (with-imported-modules '((guix build utils))
818 (let* ((home-dir (string-append "/var/run/" #$user-name))
819 (ssh-dir (string-append home-dir "/.ssh"))
820 (known-hosts-file (string-append ssh-dir "/known_hosts")))
821 (call-with-output-file #$log-file (const #t))
826 (call-with-output-file known-hosts-file
828 (for-each (lambda (host) (display host port) (newline port))
830 (display-hint (G_ "webssh: reject policy requires `known-hosts'.")))))
831 (for-each (lambda (file)
833 (passwd:uid (getpw #$user-name))
834 (group:gid (getpw #$group-name))))
835 (list #$log-file ssh-dir known-hosts-file))
836 (chmod ssh-dir #o700)))))))
838 (define webssh-shepherd-service
840 (($ <webssh-configuration> package user-name group-name policy _ port
841 address log-file log-level)
842 (list (shepherd-service
843 (provision '(webssh))
844 (documentation "Run webssh daemon.")
845 (start #~(make-forkexec-constructor
846 `(,(string-append #$webssh "/bin/wssh")
847 ,(string-append "--log-file-prefix=" #$log-file)
849 ((debug) '("--logging=debug"))
852 ((reject) '("--policy=reject"))
855 (list (string-append "--port=" (number->string #$port)))
858 (list (string-append "--address=" #$address))
861 #:group #$group-name))
862 (stop #~(make-kill-destructor)))))))
864 (define webssh-service-type
868 (list (service-extension shepherd-root-service-type
869 webssh-shepherd-service)
870 (service-extension account-service-type
872 (service-extension activation-service-type
874 (default-value (webssh-configuration))
878 ;;; ssh.scm ends here