An interesting thing here is that logging in as a “regular” user with a declared public key works without issue. I would expect those ought to go through authorized_keys_command as well?
There are a handful of things going wrong right now, and I haven’t pinpointed the exact issue yet but using /run/current-system/sw/bin/sshd -ddd -D -f /test_sshd_config to run one-off sshd sessions has increased debugging velocity.
One observation is that #! /usr/bin/env nix-shell does not seem to work with AuthorizedKeysCommand:
debug3: subprocess: AuthorizedKeysCommand command "/ssh-proxy/authorized_keys_command skainswo" running as skainswo (flags 0x6)
...
debug3: subprocess: AuthorizedKeysCommand pid 43090
...
/usr/bin/env: 'nix-shell': No such file or directory
debug2: auth_check_authkeys_file: /ssh-proxy/authorized_keys_command "%u": processed 0/0 lines
AuthorizedKeysCommand /ssh-proxy/authorized_keys_command skainswo failed, status 127
and neither does #! /usr/bin/env bash.
Anyone have any ideas how to get a working script shebang here?
you should probably just use something writeShellApplication then either use tmpfiles to copy/paste it into a directory you find acceptable, or environment.etc… and then you can avoid nasty nix-shell shebangs which might end up with you waiting a long time to ssh into your server on occasion
i don’t think /usr/bin/env is the problem - nix-shell is. you’ve made the assumption that nix-shell is available inside the sshd service, which it is not. presumably if you added the nix package to the systemd service, as well as the environment variables & configuration required for nix-shell to work (like NIX_PATH) then your script would work…
at this point you can probably see more than a few reasons why i suggested what i did