summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2020-12-11 17:26:03 +0100
committerLudovic Courtès <ludo@gnu.org>2020-12-11 19:06:53 +0100
commitd8051557aee9fa252b015ff67cc15681e8540777 (patch)
treea597aab9159aca50c89eb727d55357ac9161ce28
parent26b1030012837ff3f91d2a39971358180324d730 (diff)
Revert "services: openssh: Warn about 'password-authentication?' default."
This reverts commit aecd2a13cbd8301d0fdeafcacbf69e12cc3f6138 for two reasons: 1. The warning would fire every time (gnu services ssh) is loaded; 2. There's still no clear consensus on the approach to follow as discussed in <https://issues.guix.gnu.org/44808>.
-rw-r--r--gnu/installer/services.scm8
-rw-r--r--gnu/services/ssh.scm18
2 files changed, 4 insertions, 22 deletions
diff --git a/gnu/installer/services.scm b/gnu/installer/services.scm
index 14a3bb9be69..ec5ea30594a 100644
--- a/gnu/installer/services.scm
+++ b/gnu/installer/services.scm
@@ -1,6 +1,6 @@
1;;; GNU Guix --- Functional package management for GNU 1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com> 2;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
3;;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org> 3;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
4;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org> 4;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
5;;; 5;;;
6;;; This file is part of GNU Guix. 6;;; This file is part of GNU Guix.
@@ -93,11 +93,7 @@
93 (system-service 93 (system-service
94 (name (G_ "OpenSSH secure shell daemon (sshd)")) 94 (name (G_ "OpenSSH secure shell daemon (sshd)"))
95 (type 'networking) 95 (type 'networking)
96 (snippet '((service openssh-service-type 96 (snippet '((service openssh-service-type))))
97 (openssh-configuration
98 ;; Currently the default is #t but it's considered
99 ;; unsafe. Explicitly pass #f.
100 (password-authentication? #f))))))
101 (system-service 97 (system-service
102 (name (G_ "Tor anonymous network router")) 98 (name (G_ "Tor anonymous network router"))
103 (type 'networking) 99 (type 'networking)
diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index 1e45495e1bd..1891db04876 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -1,5 +1,5 @@
1;;; GNU Guix --- Functional package management for GNU 1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org> 2;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
3;;; Copyright © 2016 David Craven <david@craven.ch> 3;;; Copyright © 2016 David Craven <david@craven.ch>
4;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu> 4;;; Copyright © 2016 Julien Lepiller <julien@lepiller.eu>
5;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org> 5;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
@@ -33,9 +33,6 @@
33 #:use-module (guix gexp) 33 #:use-module (guix gexp)
34 #:use-module (guix records) 34 #:use-module (guix records)
35 #:use-module (guix modules) 35 #:use-module (guix modules)
36 #:use-module ((guix i18n) #:select (G_))
37 #:use-module ((guix diagnostics) #:select (warning source-properties->location))
38 #:use-module ((guix memoization) #:select (mlambda))
39 #:use-module (srfi srfi-1) 36 #:use-module (srfi srfi-1)
40 #:use-module (srfi srfi-26) 37 #:use-module (srfi srfi-26)
41 #:use-module (ice-9 match) 38 #:use-module (ice-9 match)
@@ -279,16 +276,6 @@ The other options should be self-descriptive."
279;;; OpenSSH. 276;;; OpenSSH.
280;;; 277;;;
281 278
282(define true-but-soon-false
283 (mlambda (loc)
284 ;; The plan is to change the default 'password-authentication?' to #f in
285 ;; Guix 1.3.0 or so. See <https://issues.guix.gnu.org/44808>.
286 (warning (source-properties->location loc)
287 (G_ "The default value of the 'password-authentication?'
288field of 'openssh-configuration' will change from #true to #false in the
289future. Explicitly set it to #true to allow password authentication.~%"))
290 #t))
291
292(define-record-type* <openssh-configuration> 279(define-record-type* <openssh-configuration>
293 openssh-configuration make-openssh-configuration 280 openssh-configuration make-openssh-configuration
294 openssh-configuration? 281 openssh-configuration?
@@ -309,8 +296,7 @@ future. Explicitly set it to #true to allow password authentication.~%"))
309 (default #f)) 296 (default #f))
310 ;; Boolean 297 ;; Boolean
311 (password-authentication? openssh-configuration-password-authentication? 298 (password-authentication? openssh-configuration-password-authentication?
312 (default (true-but-soon-false 299 (default #t))
313 (current-source-location))))
314 ;; Boolean 300 ;; Boolean
315 (public-key-authentication? openssh-configuration-public-key-authentication? 301 (public-key-authentication? openssh-configuration-public-key-authentication?
316 (default #t)) 302 (default #t))