fedora-iot / ostree

#98 fix: restore SSH key management for Ignition
Merged by pbrobinson. Opened by pwhalen.
fedora-iot/ pwhalen/ostree ssh-key-fix  into  main

Download 98.patch

Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in
addition to authorized_keys, restoring functionality lost when
ssh-key-dir was removed.

Follows the same approach as CoreOS:
https://github.com/coreos/fedora-coreos-config/pull/3885

Signed-off-by: Paul Whalen pwhalen@fedoraproject.org

rebased onto 240bff70e742b6916271144f9d61ca79bc98f24b

This is overall fine to fix the problem, i think the files/dirs we're creating here should be part of a package

Pull-Request has been merged by pbrobinson

so /etc/ssh/sshd_config.d belongs to openssh-server and systemd so we should never have to create it

And as 40-authorized-keys-file.conf is basically a static config file it should likely be part of the ignition and/or afterburn package so it can be properly managed.

Also I question the 40- runtime number as we have the following:
40-redhat-crypto-policies.conf
50-redhat.conf

I think the -authorized-keys-file.conf should be 60+ in numbering so the crypto policies and redhat (which specifies things like PAM/GSSAPI configs) are executed before this one and hence ensure the keys get all the previous policies applied.

I would actually name this 90 as it's basically sourcing user keys and everything else should be enforced first.

FYI I proposed https://src.fedoraproject.org/rpms/ignition/pull-request/143 to handle this

Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.