c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

baremetal: regen 3072 bit rsa keys

This commit is contained in:
Sandro - 2023-06-22 22:23:38 +02:00
parent 00000017b2
commit 000000710a
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/baremetal.nix
View File

@ -58,12 +58,20 @@
smartd.enable = true;
};
system.activationScripts.generateInitrdOpensshHostKeys = lib.mkIf config.boot.initrd.network.ssh.enable ''
system.activationScripts.generateInitrdOpensshHostKeys = let
sshKeygen = "${config.programs.ssh.package}/bin/ssh-keygen";
in lib.mkIf config.boot.initrd.network.ssh.enable ''
if [[ ! -e ${initrdEd2219Key} || ! -e ${initrdRsaKey} ]]; then
echo "Generating initrd OpenSSH hostkeys..."
mkdir -m700 -p /etc/ssh/initrd/
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${initrdEd2219Key}
${pkgs.openssh}/bin/ssh-keygen -t rsa -N "" -f ${initrdRsaKey}
${sshKeygen} -t ed25519 -N "" -f ${initrdEd2219Key}
${sshKeygen} -t rsa -b 4096 -N "" -f ${initrdRsaKey}
fi
if [[ -e ${initrdRsaKey} && $(${sshKeygen} -l -f ${initrdRsaKey} | ${pkgs.gawk}/bin/awk '{print $1}') == 3072 ]]; then
echo "Upgrading RSA initrd OpenSSH hostkey with only 3072 bit..."
rm -f ${initrdRsaKey} ${initrdRsaKey}.pub
${sshKeygen} -t rsa -b 4096 -N "" -f ${initrdRsaKey}
fi
'';
};