Why programs.ssh generates world-readable ~/.ssh/config?

Help
1

I have this ssh configuration in my config (programs.ssh in home.nix / home-manager) (still on nixos-25.11):

      ssh = {
        enable = true;

        enableDefaultConfig = false;

        matchBlocks."*" = {
          controlPersist = "10m";
          controlPath = "~/.ssh/socket-%C";
          # default in nixpkgs until 25.11 was controlMaster no, I take it from options atop
          inherit (cfg) controlMaster;
          hashKnownHosts = true;
          serverAliveInterval = 30;
          compression = true;

          # see https://github.com/nix-community/home-manager/blob/d1686dc7d36cbd1234cb226ad6ef97e882716acb/modules/programs/ssh.nix#L651
          # default values copied here
          forwardAgent = false;
          addKeysToAgent = "no";
          #          userKnownHostsFile = "~/.ssh/known_hosts";
          forwardX11Trusted = true;
          identitiesOnly = true;
          # FIXME issue with gitolite, see https://stackoverflow.com/a/2510548
          sendEnv = [
            "LANG"
            "LC_*"
          ];
        };

	matchBlocks."nixbuild-shell" = {
            hostname  = "eu.nixbuild.net";
            user = "root";
	    extraOptions = {
            "LogLevel" = "Debug1";
            "IgnoreUnknown" = "WarnWeakCrypto";
            "WarnWeakCrypto" = "no-pq-kex";
            "PubKeyAcceptedKeyTypes" = "ssh-ed25519";
            "IPQoS" = "throughput";
	    };
            serverAliveInterval = 60;
            identitiesOnly = true;
            identityFile = "/home/nixos/.ssh/id_ed25519";
	};

        # WARNING might break ssh nixbuild setup again
        # UPDATE seemed to work, build reads /etc/ssh/ssh_config
        includes = [
          "~/.ssh/config.d/*"
        #  "/etc/ssh/ssh_config"
        ];

        extraConfig = lib.concatLines [
          # Specifies the timeout (in seconds) used when connecting to the SSH server, instead of using the default system TCP timeout
          "ConnectTimeout 60"
          # ssh-keysign is disabled by default and can only be enabled in the global client configuration file /etc/ssh/ssh_config by setting EnableSSHKeysign to “yes”
          "EnableSSHKeysign yes"
          # Specifies whether ssh should terminate the connection if it cannot set up all requested dynamic, tunnel, local, and remote port forwardings
          "ExitOnForwardFailure yes"
          # This option can be used if the home directory is shared across machines. In this case localhost will refer to a different machine on each of the machines and the user will get many warnings about changed host keys
          "NoHostAuthenticationForLocalhost yes"
          "Protocol 2"
          "PubKeyAuthentication yes"
        ];

        # Extra SSH configuration options that take precedence over any host specific configuration.
        #extraOptionOverrides = {};
      };

The config file has rwx for everyone, why is that ?

$ ls -la ~/.ssh/config
Permissions Size User Date Modified Name
lrwxrwxrwx - nixos 8 Jun 09:37 󱁻 /home/nixos/.ssh/config → /nix/store/659cmx1mjswj9l5na46rbyw7mi9zzw1f-home-manager-files/.ssh/config

2

Symlinks are always rwx. The permissions on the link don’t matter anyway.

3 Likes