From 3eb85b3aceed4b378cdb719a53a289bf486b5d05 Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 16:30:45 -0700 Subject: [PATCH 1/7] use openssh_gssapi for sshd on all hosts --- modules/auth.nix | 1 + profiles/desktop.nix | 10 ++++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/auth.nix b/modules/auth.nix index 812187f3..12c22cca 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -109,6 +109,7 @@ in }; }; + services.openssh.package = pkgs.openssh_gssapi; services.openssh.settings = { GSSAPIAuthentication = "yes"; GSSAPICleanupCredentials = "yes"; diff --git a/profiles/desktop.nix b/profiles/desktop.nix index 9db45611..55fc83d9 100644 --- a/profiles/desktop.nix +++ b/profiles/desktop.nix @@ -116,15 +116,17 @@ in # More info: https://nix.dev/guides/faq#how-to-run-non-nix-executables programs.nix-ld.enable = true; - # Enable ticket forwarding on desktops (no password when sshing to other ocf hosts from the desktops thru supernova!) - # disabled on everything else bc they dont need to jump through hosts like that... + # Only forward Kerberos tickets to login servers (fluttershy and rainbowdash) programs.ssh.extraConfig = lib.mkOverride 90 '' CanonicalizeHostname yes CanonicalDomains ocf.berkeley.edu - Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::* + Host fluttershy.ocf.berkeley.edu rainbowdash.ocf.berkeley.edu GSSAPIAuthentication yes GSSAPIKeyExchange yes GSSAPIDelegateCredentials yes + Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::* + GSSAPIAuthentication yes + GSSAPIKeyExchange yes + GSSAPIDelegateCredentials no ''; - # TODO: only forward kerberos tickets to login servers (currently supernova and tsunami)! } From 7e0d373b64d98fcf4cfbb8e5fa91d2d6ca02febe Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 16:45:57 -0700 Subject: [PATCH 2/7] GSSAPIKeyExchange = yes if host has a keytab --- modules/auth.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auth.nix b/modules/auth.nix index 12c22cca..29348895 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -118,7 +118,7 @@ in # algorithm. lets disable gssapi key exchange and use ssh's default key # exchanges (which supports post-quantum safe key exchange). # Only enable key exchange if host has a keytab - #GSSAPIKeyExchange = lib.mkIf hasKeytab "yes"; + GSSAPIKeyExchange = lib.mkIf hasKeytab "yes"; }; }; } From 14c9798977e5711b3e968b2e0068144c21fa993b Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 16:53:45 -0700 Subject: [PATCH 3/7] test an option --- modules/auth.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auth.nix b/modules/auth.nix index 29348895..dfb69ee9 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -119,6 +119,7 @@ in # exchanges (which supports post-quantum safe key exchange). # Only enable key exchange if host has a keytab GSSAPIKeyExchange = lib.mkIf hasKeytab "yes"; + GSSAPIStoreCredentialsOnRekey = "yes"; }; }; } From d4cc9fe30071d2479402dc1d6a369c560aa1cbfc Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 17:04:10 -0700 Subject: [PATCH 4/7] ticket forwarding flag --- modules/auth.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auth.nix b/modules/auth.nix index dfb69ee9..b5f81b66 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -105,6 +105,7 @@ in }; libdefaults = { default_realm = "OCF.BERKELEY.EDU"; + forwardable = true; }; }; }; From ae44e811d1388ce4dddd4da62c997875b8b8a23d Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 17:06:11 -0700 Subject: [PATCH 5/7] undo unhelpful option --- modules/auth.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auth.nix b/modules/auth.nix index b5f81b66..34a91fec 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -119,8 +119,7 @@ in # algorithm. lets disable gssapi key exchange and use ssh's default key # exchanges (which supports post-quantum safe key exchange). # Only enable key exchange if host has a keytab - GSSAPIKeyExchange = lib.mkIf hasKeytab "yes"; - GSSAPIStoreCredentialsOnRekey = "yes"; + #GSSAPIKeyExchange = lib.mkIf hasKeytab "yes"; }; }; } From 3d0c2639a7d61129cddc7222b89c9380dce86237 Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 17:17:17 -0700 Subject: [PATCH 6/7] test without specifying openssh package --- modules/auth.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/auth.nix b/modules/auth.nix index 34a91fec..d8042a3e 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -110,7 +110,6 @@ in }; }; - services.openssh.package = pkgs.openssh_gssapi; services.openssh.settings = { GSSAPIAuthentication = "yes"; GSSAPICleanupCredentials = "yes"; From f13144d5064c94d2735fded9f014b0c643a3dc9b Mon Sep 17 00:00:00 2001 From: jaysa68 Date: Wed, 1 Apr 2026 17:53:34 -0700 Subject: [PATCH 7/7] implement oliver suggestions --- modules/auth.nix | 1 - profiles/desktop.nix | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/auth.nix b/modules/auth.nix index d8042a3e..812187f3 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -105,7 +105,6 @@ in }; libdefaults = { default_realm = "OCF.BERKELEY.EDU"; - forwardable = true; }; }; }; diff --git a/profiles/desktop.nix b/profiles/desktop.nix index 55fc83d9..9619e5de 100644 --- a/profiles/desktop.nix +++ b/profiles/desktop.nix @@ -116,6 +116,9 @@ in # More info: https://nix.dev/guides/faq#how-to-run-non-nix-executables programs.nix-ld.enable = true; + # Add forward flag to tickets on desktops + security.krb5.settings.libdefaults.forwardable = true; + # Only forward Kerberos tickets to login servers (fluttershy and rainbowdash) programs.ssh.extraConfig = lib.mkOverride 90 '' CanonicalizeHostname yes @@ -127,6 +130,5 @@ in Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::* GSSAPIAuthentication yes GSSAPIKeyExchange yes - GSSAPIDelegateCredentials no ''; }