From 6fd9541ed6c13b14ee5d3c8e4b40079d828f3f63 Mon Sep 17 00:00:00 2001 From: Benedikt Peetz Date: Mon, 1 Jul 2024 18:08:07 +0200 Subject: fix(system/services/openssh): Update to fix CVE-2024-6387 “regreSSHion” MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This should already be in 24.04, but it does not work currently :<. --- flake.lock | 76 +++++++++++++++++++--------------- flake.nix | 4 +- system/services/openssh/default.nix | 9 +++- system/services/openssh/new_module.nix | 7 ++++ 4 files changed, 59 insertions(+), 37 deletions(-) create mode 100644 system/services/openssh/new_module.nix diff --git a/flake.lock b/flake.lock index e3c048a..e1d7eca 100644 --- a/flake.lock +++ b/flake.lock @@ -12,11 +12,11 @@ ] }, "locked": { - "lastModified": 1716561646, - "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=", + "lastModified": 1718371084, + "narHash": "sha256-abpBi61mg0g+lFFU0zY4C6oP6fBwPzbHPKBGw676xsA=", "owner": "ryantm", "repo": "agenix", - "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9", + "rev": "3a56735779db467538fb2e577eda28a9daacaca6", "type": "github" }, "original": { @@ -48,11 +48,11 @@ ] }, "locked": { - "lastModified": 1717951870, - "narHash": "sha256-hGLeRxSEeFz9WvmQ4s4AuMJ5InLSZvoczDdXkWSFi1A=", + "lastModified": 1719685792, + "narHash": "sha256-WIoVERD4AN6CmfGSRPy3mfPx2dDbRHgzP2V8z6aNbaY=", "owner": "ipetkov", "repo": "crane", - "rev": "17d9e9dedd58dde2c562a4296934c6d6a0844534", + "rev": "aa5dcd0518a422dfd545d565f0d5a25971fea52a", "type": "github" }, "original": { @@ -90,11 +90,11 @@ ] }, "locked": { - "lastModified": 1718008439, - "narHash": "sha256-nlh/2uD5p2SAdkn6Zuey20yaR5FFWvhL3poapDGNE4Y=", + "lastModified": 1719733833, + "narHash": "sha256-6h2EqZU9bL9rHlXE+2LCBgnDImejzbS+4dYsNDDFlkY=", "owner": "nix-community", "repo": "disko", - "rev": "c1cfbfad7cb45f0c177b35b59ba67d1b5fc7ca82", + "rev": "d185770ea261fb5cf81aa5ad1791b93a7834d12c", "type": "github" }, "original": { @@ -162,11 +162,11 @@ }, "impermanence": { "locked": { - "lastModified": 1717932370, - "narHash": "sha256-7C5lCpiWiyPoIACOcu2mukn/1JRtz6HC/1aEMhUdcw0=", + "lastModified": 1719091691, + "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=", "owner": "nix-community", "repo": "impermanence", - "rev": "27979f1c3a0d3b9617a3563e2839114ba7d48d3f", + "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a", "type": "github" }, "original": { @@ -177,11 +177,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1717976148, - "narHash": "sha256-RmiZ7RBRO7D5pZKy4yhdtPkfezWUXjUTUD0JBxq1+14=", + "lastModified": 1719825363, + "narHash": "sha256-2ASBatUTQWNIiTeBZRuxROu27MyOavVnzeCv7h40QNw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f589903f0c98110b2ad5fdd764950a99ec26715e", + "rev": "10c832d0548e9e3a6df7eb51e68c2783212a303e", "type": "github" }, "original": { @@ -191,13 +191,28 @@ "type": "github" } }, + "nixpkgs-24_05": { + "locked": { + "lastModified": 1717144377, + "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "805a384895c696f802a9bf5bf4720f37385df547", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-24.05", + "type": "indirect" + } + }, "nixpkgs-unstable": { "locked": { - "lastModified": 1718027362, - "narHash": "sha256-Eg2U1nwo5JBmsZ/2RAqXv/4E9clucexY/76P8kMC9Gs=", + "lastModified": 1719824438, + "narHash": "sha256-pY0wosAgcr9W4vmGML0T3BVhQiGuKoozCbs2t+Je1zc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f12b3b98676c3a9c9373576965743fa30b972b31", + "rev": "7f993cdf26ccef564eabf31fdb40d140821e12bc", "type": "github" }, "original": { @@ -226,11 +241,11 @@ ] }, "locked": { - "lastModified": 1709831932, - "narHash": "sha256-WsP8rOFa/SqYNbVtYJ/l2mWWOgyDTJFbITMV8tv0biI=", + "lastModified": 1718869541, + "narHash": "sha256-smhpGh1x/8mNl+sFL8SbeWnx0bK4HWjmdRA3mIwGjPU=", "owner": "yaxitech", "repo": "ragenix", - "rev": "06de099ef02840ec463419f12de73729d458e1eb", + "rev": "8a254bbaa93fbd38e16f70fa81af6782794e046e", "type": "github" }, "original": { @@ -257,19 +272,16 @@ }, "rust-overlay": { "inputs": { - "flake-utils": [ - "flake-utils" - ], "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1717985971, - "narHash": "sha256-24h/qKp0aeI+Ew13WdRF521kY24PYa5HOvw0mlrABjk=", + "lastModified": 1719800573, + "narHash": "sha256-9DLgG4T6l7cc4pJNOCcXGUwHsFfUp8KLsiwed65MdHk=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "abfe5b3126b1b7e9e4daafc1c6478d17f0b584e7", + "rev": "648b25dd9c3acd255dc50c1eb3ca8b987856f675", "type": "github" }, "original": { @@ -287,16 +299,14 @@ "nixpkgs": [ "nixpkgs" ], - "utils": [ - "flake-utils" - ] + "nixpkgs-24_05": "nixpkgs-24_05" }, "locked": { - "lastModified": 1717515088, - "narHash": "sha256-nWOLpPA7+k7V1OjXTuxdsVd5jeeI0b13Di57wvnqkic=", + "lastModified": 1718697807, + "narHash": "sha256-Enla61WFisytTYbWygPynEbu8vozjeGc6Obkj2GRj7o=", "owner": "simple-nixos-mailserver", "repo": "nixos-mailserver", - "rev": "0d51a32e4799d081f260eb4db37145f5f4ee7456", + "rev": "290a995de5c3d3f08468fa548f0d55ab2efc7b6b", "type": "gitlab" }, "original": { diff --git a/flake.nix b/flake.nix index b68c12f..fc3c2ed 100644 --- a/flake.nix +++ b/flake.nix @@ -29,7 +29,6 @@ url = "github:oxalica/rust-overlay"; inputs = { nixpkgs.follows = "nixpkgs"; - flake-utils.follows = "flake-utils"; }; }; @@ -56,7 +55,6 @@ inputs = { flake-compat.follows = "flake-compat"; nixpkgs.follows = "nixpkgs"; - utils.follows = "flake-utils"; }; }; @@ -95,7 +93,7 @@ specialArgs = attrs // { - inherit pkgsUnstable; + inherit pkgsUnstable nixpkgs-unstable; }; modules = [ ./modules/nixos diff --git a/system/services/openssh/default.nix b/system/services/openssh/default.nix index 46b7ffd..46a9782 100644 --- a/system/services/openssh/default.nix +++ b/system/services/openssh/default.nix @@ -1,7 +1,14 @@ -{...}: { +{pkgsUnstable, ...}: { + imports = [ + ./new_module.nix + ]; + services.openssh = { enable = true; settings.PasswordAuthentication = false; + + package = pkgsUnstable.openssh; + hostKeys = [ { # See the explanation for this in /system/impermanence/mods/openssh.nix diff --git a/system/services/openssh/new_module.nix b/system/services/openssh/new_module.nix new file mode 100644 index 0000000..878f9de --- /dev/null +++ b/system/services/openssh/new_module.nix @@ -0,0 +1,7 @@ +{...} @ args: { + disabledModules = ["services/networking/ssh/sshd.nix"]; + + imports = [ + "${args.nixpkgs-unstable}/nixos/modules/services/networking/ssh/sshd.nix" + ]; +} -- cgit 1.4.1