Unverified Commit 88946fe4 authored by Sandro Jäckel's avatar Sandro Jäckel
Browse files

nixos/ssh: add variant to not set ForwardX11 

ssh_config allows a setting to only be set once and if more complex
conditions are used than having ForwardX11 already defined can be a
problem.
parent 7eff362c

nixos/modules/programs/ssh.nix

+6 −8
Original line number Diff line number Diff line
@@ -50,10 +50,11 @@ in 
      };



      forwardX11 = mkOption {

        type = types.bool;

        type = with lib.types; nullOr bool;

        default = false;

        description = lib.mdDoc ''

          Whether to request X11 forwarding on outgoing connections by default.

          If set to null, the option is not set at all.

          This is useful for running graphical programs on the remote machine and have them display to your local X11 server.

          Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two.

          Note: there are some security risks to forwarding an X11 connection.
@@ -279,10 +280,10 @@ in 
  config = {



    programs.ssh.setXAuthLocation =

      mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 || config.services.openssh.settings.X11Forwarding);

      mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 == true || config.services.openssh.settings.X11Forwarding);



    assertions =

      [ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;

      [ { assertion = cfg.forwardX11 == true -> cfg.setXAuthLocation;

          message = "cannot enable X11 forwarding without setting XAuth location";

        }

      ] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
@@ -303,11 +304,8 @@ in 
        AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}

        GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}



        ${optionalString cfg.setXAuthLocation ''

          XAuthLocation ${pkgs.xorg.xauth}/bin/xauth

        ''}



        ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}

        ${optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}

        ${lib.optionalString (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"}



        ${optionalString (cfg.pubkeyAcceptedKeyTypes != []) "PubkeyAcceptedKeyTypes ${concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}

        ${optionalString (cfg.hostKeyAlgorithms != []) "HostKeyAlgorithms ${concatStringsSep "," cfg.hostKeyAlgorithms}"}