Skip to content

Commit 80fa6bb

Browse files
jaysa68jaysa68
authored
small fixes after login server renames (#237)
* fix ssh config for login server rename * rekey secrets * update login server hostkey names * update comment * agenix rekey for paper cmd secret * add secret option to koi host file * disable reserve dns for kerberos * rekey secrets (second half of eric root)
1 parent 06dc609 commit 80fa6bb

206 files changed

Lines changed: 435 additions & 414 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎hosts/servers/koi.nix‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@
2121
mountServices = true;
2222
};
2323

24+
age.secrets.ocfprinting = {
25+
rekeyFile = ../../secrets/master-keyed/ocfprinting.age;
26+
path = "/etc/ocfprinting.json";
27+
owner = "root";
28+
group = "ocfstaff";
29+
mode = "0640";
30+
};
31+
2432
environment.systemPackages = with pkgs; [
2533
ocf-utils
2634
openldap

‎hosts/servers/zecora.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
description = "Unifi console.";
2222
};
2323

24-
services.unifi.enable = true;
24+
services.unifi.enable = false;
2525

2626
system.stateVersion = "24.11";
2727
}

‎modules/auth.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ in
105105
};
106106
libdefaults = {
107107
default_realm = "OCF.BERKELEY.EDU";
108+
rdns = false;
108109
};
109110
};
110111
};

‎profiles/desktop.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,11 +119,11 @@ in
119119
# Add forward flag to tickets on desktops
120120
security.krb5.settings.libdefaults.forwardable = true;
121121

122-
# Only forward Kerberos tickets to login servers (fluttershy and rainbowdash)
122+
# Only forward Kerberos tickets to login servers (carp and koi)
123123
programs.ssh.extraConfig = lib.mkOverride 90 ''
124124
CanonicalizeHostname yes
125125
CanonicalDomains ocf.berkeley.edu
126-
Host fluttershy.ocf.berkeley.edu rainbowdash.ocf.berkeley.edu
126+
Host carp.ocf.berkeley.edu koi.ocf.berkeley.edu
127127
GSSAPIAuthentication yes
128128
GSSAPIKeyExchange yes
129129
GSSAPIDelegateCredentials yes

‎secrets/host-keys/carp.pub‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPm+RlDujsxQyxFTEOCTeImSBDvr63cL8Kg+rNrH6NK8 root@fluttershy
1+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPm+RlDujsxQyxFTEOCTeImSBDvr63cL8Kg+rNrH6NK8 root@carp

‎secrets/host-keys/koi.pub‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuA9ZE0li8vj6YAzJS5wE2grmjMeMcYmbZqVJJNEFxQ root@rainbowdash
1+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuA9ZE0li8vj6YAzJS5wE2grmjMeMcYmbZqVJJNEFxQ root@koi

‎secrets/master-keyed/ocfprinting.age‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
age-encryption.org/v1
2+
-> X25519 WXvVaZN3qegm2mjd3evLF5bSglTku9Vow19E8IYGzjc
3+
pQ3Pan2V2XYkCaO9IwaHnVzbnVxfljENCPNC99/D26c
4+
-> X25519 AlpbID2D9PyF7OTDBFxR04cFoRNr9jLizGnfoiMW3SA
5+
jqo+E+GMrBPfTf7X0sJmo7pvEntKj+FdoWlV/xvP3+o
6+
-> X25519 P+I4XZQ4W5KXsnwRD/s/YvX//qGdPngJ0O4ZUuzQ3BU
7+
+XFJ1k2BpoB6rZx//hljcOu515JVe0aXoFuZhxI+uU8
8+
-> X25519 aysFaOzOWV0br1WaFKN8MvURojEKvg9ycJy1OE8tABU
9+
8OufLjbmLhrx4n5MmbFlO2SnpblRVZmFvPNsWxe2Ib4
10+
-> X25519 Hk3SVulNsnDaVstGGb+nYI82nW3SjHEWSrWzxh53ISc
11+
BPz50suQAV4ArrXTE1O2d4pQjxd/9FG3LSV+1uYsjyE
12+
-> X25519 s/IKW0fv4j6U7f6vwhBmHSrJpiMhfENzc+KgP9jb3UI
13+
hzcP/7xpoBeo3S+WZOeIgRIioT6P743+f7X4gqn40z8
14+
-> X25519 0LxiiRhafHvaeh33yXAhFHMt12D825QEcHdzPruK3Bk
15+
rEdD9BKmr6u6DkBquBS5pKYni9kdEMh4Mt2/JqR6Q5A
16+
-> X25519 wijgSjx3nDFfJI8JVWtRnrc6OjejLwN2Ca+e2/QAWC4
17+
dNcPJjd0ed22rM324T/D0i98CZHJVyttew4K04tbMYo
18+
-> X25519 9/2SAS3kxSpyJUYzoB2LUgY5bkNvr3+DYHBCv9w+Rgs
19+
S5aBxgPCMOIzUYX75KnN/KXui/0XcxbXw5lvPIhDv9c
20+
-> X25519 iGNyPiNrX/fIDswfwk3Kn/cDqPe0Gz1cRDi9/rdiuDs
21+
KNPCyBJTt7u1hGJYaz85oLznj7I+SB7e1BVXGZqILGE
22+
-> X25519 EOKWvPoghTfmh9NURsTuSwikRzRaGjx0FFazI0SCVRI
23+
TK6GCiAf49yy50hAI8wGu8yF53AXQ5qT9DBxQMZQ9P0
24+
-> X25519 cvT6A+YY4r9h20Y+Qu6q0xIPTDo1ZnwEuO4qJbTBnwM
25+
lg8xym6ptpyB2n0uTB8YMoyUK2HuegTRE0Q0w6Z2oLI
26+
-> X25519 rnfBULedtzr0TEGhscaz43V/FUG9N1DMCzRGRMuYqjg
27+
BXhEgfIztOk4vcBzRZe8b6MvTjz7u9RxvSWCqkh2q64
28+
--- sn7WpUkRisheIKabOcUlfFfwLjqBuY5MLhebPYP3wRk
29+
J놅t{��qX� �^TX�j�ƭ̊[N�0z�1��]&!���ϵ�3�[�0��r��xNes�v���|j r�hX�m���V���ie�5n8>^6

‎secrets/rekeyed/adenine/371beaefed71409c8be4005529e9b79e-krb5-keytab.age‎

-663 Bytes
Binary file not shown.

‎secrets/rekeyed/adenine/45643bfd848675c57dae624dece4b397-tsig-secret.age‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎secrets/rekeyed/adenine/c3b3fbc602a4a8011668cc45384e7f07-tsig-secret.age‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
age-encryption.org/v1
2+
-> ssh-ed25519 sVsl7A zju9qzgDb26dKs1D25SimTO1wtJZqHn2X2U+Y1waciA
3+
D/JZd9NqGD+gnxvzHzN3QbUeCiwN+KWyIoe7IM6CXMw
4+
-> {yL-grease
5+
wa9fOxjUWVg0E8peIH7gWZN3WE8c7K4eKLRbZ8DrSNBO9z/u2DMD1Thg2uIFzbJG
6+
HllA4n27zLgeLK0WHVh8YEh4wb2MjXzVnw0o2uRW1AAzpVJOJQ
7+
--- uHTL6NFOxEI/uiNwduFfT63t198V+jTLBL7mJ/wRkFQ
8+
��;��,�D���0`���(��b��R�w��e�~���(�g60���^>5�o=��I@���L $ҟ-֡�GI�Q�j=L U�5�e�J_d�ֹ-Ia{�WeY�x�Neա`2��J<���

0 commit comments

Comments
 (0)