pam_ssh_agent_auth: Honour services.openssh.authorizedKeysFiles

If a system administrator has explicitly configured key locations this should be taken into account by `sudo`.
2020-11-24 02:47:07 +01:00
parent 5917193cef
commit ba1fa0c604
3 changed files with 9 additions and 2 deletions
@@ -396,7 +396,7 @@ let
          ${optionalString cfg.logFailures
              "auth required pam_tally.so"}
          ${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
-              "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
+              "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}"}
          ${optionalString cfg.fprintAuth
              "auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so"}
          ${let p11 = config.security.pam.p11; in optionalString cfg.p11Auth