3 ms·
Dupe of https://news.ycombinator.com/item?id=21270861 https://news.ycombinator.com/item?id=21270861 https://news.ycombinator.com/item?id=21279720 https://news.
by mason55 7y ago
Dupe of
https://news.ycombinator.com/item?id=21270861 https://news.ycombinator.com/item?id=21270861
https://news.ycombinator.com/item?id=21279720 https://news.ycombinator.com/item?id=21279720
What I don't get is why this needs to be tied to making the home dir a LUKS container.
Like why can't we just implement the part that doesn't involve solving the SSH issues and then add on the SSH fixes (which I don't believe are issues anyway?)
- exabrial 7y agoYou're correct, they aren't issues. What's scary to me is someone is proposing to rewrite how home directories work in unix, and doesn't even know about AuthorizedKeysCommand in OpenSSH and is planning massive workarounds because of that.
- exabrial 7y agoSome of these downvoters on HN. I pointed out the SSH issues are already taken care of. From the manpage: Specifies a program to be used to look up the user's public keys. The program must be owned by root, not writable by group or others and specified by an absolute path. Arguments to AuthorizedKeysCommand accept the tokens described in the TOKENS section. If no arguments are specified then the username of the target user is used. The program should produce on standard output zero or more lines of authorized_keys output (see AUTHORIZED_KEYS in sshd(8)). If a key supplied by AuthorizedKeysCommand does not successfully authenticate and authorize the user then public key authentication continues using the usual AuthorizedKeysFile files. By default, no AuthorizedKeysCommand is run.