security: shared user module authorizes one user's SSH key for every account #46

New Issue

2026-06-29T12:29:42+01:00

lyrathorpe commented

2026-06-29 12:29:42 +01:00

Problem

The shared system user module defined a single hardcoded SSH authorized key and applied it to users.users.${username} for whatever user a host declared. The same key was also defined a second time in the sshd hardening module. As a result:

Every account authorized that one key regardless of the account's real owner — e.g. the emmathorpe account on the WSL host authorized lyrathorpe@Lyra-MBA.
On hosts importing the sshd module the key was listed twice, producing a duplicate authorized_keys entry.

Impact

Cross-user SSH access that does not reflect the account's owner. Latent on hosts without sshd, but incorrect everywhere keys are materialized.

Resolution

Authorized keys now come from the per-user identity registry (users/registry.nix), applied once by modules/users.nix; the sshd module no longer defines keys. Each account authorizes only its own key(s). Fixed by the user-registry refactor.

## Problem The shared system user module defined a single hardcoded SSH authorized key and applied it to `users.users.${username}` for whatever user a host declared. The same key was also defined a second time in the sshd hardening module. As a result: - Every account authorized that one key regardless of the account's real owner — e.g. the `emmathorpe` account on the WSL host authorized `lyrathorpe@Lyra-MBA`. - On hosts importing the sshd module the key was listed twice, producing a duplicate `authorized_keys` entry. ## Impact Cross-user SSH access that does not reflect the account's owner. Latent on hosts without sshd, but incorrect everywhere keys are materialized. ## Resolution Authorized keys now come from the per-user identity registry (`users/registry.nix`), applied once by `modules/users.nix`; the sshd module no longer defines keys. Each account authorizes only its own key(s). Fixed by the user-registry refactor.

lyrathorpe referenced a pull request that will close this issue

2026-06-29 12:30:53 +01:00

refactor(flake): user registry, multi-user hosts, and portable home outputs #49

lyrathorpe closed this issue

2026-06-29 13:06:25 +01:00

lyrathorpe referenced this issue from a commit

2026-06-29 13:06:25 +01:00

refactor(flake): user registry, multi-user hosts, and portable home outputs (#49)

Sign in to join this conversation.