SSH publickey auth - No "authorized_keys" file gets created

Help
1

I don’t know if this is a bug or if I’m just doing something wrong, but I can’t get publickey auth to work declaritively. This is my config with users.users.USERNAME.openssh, and here is my config for services.openssh. I’ve verified the keys are matching but I still get Permission denied (publickey).

The problem, I think, is that there are no authorized_keys files being made on either the host or server.

[aaron@x86-laptop-galago:/etc/nixos]$ ls -1a /etc/ssh
.
..
ssh_config
ssh_known_hosts

[aaron@x86-laptop-galago:/etc/nixos]$ ls -1a ~/.ssh
.
..
id_ed25519
id_ed25519.pub
known_hosts
known_hosts.old

But from everything I’ve seen, it seems like at least one should be made when you set authorizedKeys.keys like I have. Comment for users.users.<username>.openssh.authorizedKeys.keys states

The contents of the files are read at build time and added to a file that the SSH daemon reads in addition to the the user’s authorized_keys file.

That doesn’t seem to happen. Then for services.openssh.authorizedKeysInHomedir

…the only files trusted by default are those in /etc/ssh/authorized_keys.d, i.e. SSH keys from users.users.USERNAME.openssh.authorizedKeys.keys.

That doesn’t happen either, as shown above.

2

That sort of configuration is fairly common and it looks like you have the options set correctly. You don’t need the authorizedKeysInHomedir and the files should show up in /etc/ssh/authorized_keys.d. The only slightly odd thing I see is that the place you import ./user is under home-manager.nixosModules. Does that work for system wide things? Can you try this change and see if it makes a difference?

           mkComputerStable "x86_64-linux" ./host/x86-laptop-galago # machine specific configuration
             [
               #system-wide modules
+              ./user/aaron
               ./system/hardware/gpu/intel
               ./system/hardware/thunderbolt
               ./system/de/cosmic
2 Likes
3

Stupid mistake on my part, guess my auto-pull service failed on the server so it didn’t have the public key to my laptop on there. Thanks for looking into it anyway.