]> git.immae.eu Git - perso/Immae/Config/Nix.git/commitdiff
Patch ssh for CVE
authorIsmaël Bouya <ismael.bouya@normalesup.org>
Sun, 7 Jul 2024 00:37:19 +0000 (02:37 +0200)
committerIsmaël Bouya <ismael.bouya@normalesup.org>
Sun, 7 Jul 2024 00:40:48 +0000 (02:40 +0200)
deploy/flake.lock
flake.lock
flakes/flake.lock
flakes/private/system/flake.nix
systems/backup-2/flake.lock
systems/dilion/flake.lock
systems/eldiron/flake.lock
systems/monitoring-1/flake.lock
systems/quatresaisons/flake.lock
systems/zoldene/flake.lock

index 173774cb962fa18f1e8f2cac58eccd9dfb0e9d8c..a99897e3ba39fa80415be64cbd065d77ddc483c8 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-aQMjFircJnaQ7F/lHR7KD1kCEHqFQWPK5q52xTxJ5mI=",
+        "narHash": "sha256-dLi2BGW1KOrLq0JMSStCHPav+jOfBWt6iuYePpOvDLg=",
         "path": "../flakes",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-Xi6/nJc0tvzKA2G78B/8wFsz5AvzdETb0L6JhWbG7CY=",
+        "narHash": "sha256-Yd9Vvt/0KEhv9F03pBFl92CdVVkMKZATRydj0AuPkKY=",
         "path": "../systems/backup-2",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-4aJAofbJwlkzXZQ08yfQUdXFIIyhE/I1uh62TZoEwzw=",
+        "narHash": "sha256-dyKdDwCGS6DrHABVcaAgb8gawz3kq13kFQAZzK0FrvA=",
         "path": "../systems/dilion",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-b/hJTZhCp7ypOTYcrMfOV1Ah8KWM+yc20Nnn3UWJ024=",
+        "narHash": "sha256-9mFf3apvj5y9USQ+nA26Mb2Ft/QdlrBVjQY2bQllFSw=",
         "path": "../systems/eldiron",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-wFk8D4iOZW2iNR/5U3eaZzWWKo57CwApD8OEcfc2s+o=",
+        "narHash": "sha256-lk0Zt0avJlciIxcG3nscv+nRR/t0U1FdnnRvFQm6GUI=",
         "path": "../systems/monitoring-1",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-WEK3g7AjtjWbnB9kQ4Guqyb8QI5xzThG5blFqAU1vNo=",
+        "narHash": "sha256-oyQ4ygkPMhgjJXdg5K2jxNJ487W7F51FQfyERfp2/Hw=",
         "path": "../systems/quatresaisons",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-cfNImVC9wAtXY3Xl7gsGBMF1dTDcYUQ9Kxd8ZWLq7/E=",
+        "narHash": "sha256-G/V/UqQ+wwkek/dGJYd+nk9W0FTVCs0/oSTUPf05QV4=",
         "path": "../systems/zoldene",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "./private/system",
         "type": "path"
       },
         "nixpkgs": "nixpkgs_106"
       },
       "locked": {
-        "lastModified": 1718531880,
-        "narHash": "sha256-BqLfVL7N6dO2oWB8Xo89uvO5cG8oDCRBgsk/TUnpcYs=",
+        "lastModified": 1720312456,
+        "narHash": "sha256-QTS2+W2Azb8y2lESQp4qJTDnfy3KpX+VheajRfDBcAs=",
         "ref": "master",
-        "rev": "b0236017d9da46b98017f348d7031a69526c0aeb",
-        "revCount": 738,
+        "rev": "92f3b74c6408e446e51e6c1ff57269cac4382b16",
+        "revCount": 742,
         "type": "git",
         "url": "git+ssh://gitolite@git.immae.eu/perso/Immae/Config/Nix/Nixops/Secrets"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index cd512a6a0f7897ffc438b51c8db19cd7e1a7ad1b..f711c1f9024a277f238059830e46769855e0cf4d 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-aQMjFircJnaQ7F/lHR7KD1kCEHqFQWPK5q52xTxJ5mI=",
+        "narHash": "sha256-dLi2BGW1KOrLq0JMSStCHPav+jOfBWt6iuYePpOvDLg=",
         "path": "./flakes",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-Xi6/nJc0tvzKA2G78B/8wFsz5AvzdETb0L6JhWbG7CY=",
+        "narHash": "sha256-Yd9Vvt/0KEhv9F03pBFl92CdVVkMKZATRydj0AuPkKY=",
         "path": "../systems/backup-2",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-4aJAofbJwlkzXZQ08yfQUdXFIIyhE/I1uh62TZoEwzw=",
+        "narHash": "sha256-dyKdDwCGS6DrHABVcaAgb8gawz3kq13kFQAZzK0FrvA=",
         "path": "../systems/dilion",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-b/hJTZhCp7ypOTYcrMfOV1Ah8KWM+yc20Nnn3UWJ024=",
+        "narHash": "sha256-9mFf3apvj5y9USQ+nA26Mb2Ft/QdlrBVjQY2bQllFSw=",
         "path": "../systems/eldiron",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-wFk8D4iOZW2iNR/5U3eaZzWWKo57CwApD8OEcfc2s+o=",
+        "narHash": "sha256-lk0Zt0avJlciIxcG3nscv+nRR/t0U1FdnnRvFQm6GUI=",
         "path": "../systems/monitoring-1",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-WEK3g7AjtjWbnB9kQ4Guqyb8QI5xzThG5blFqAU1vNo=",
+        "narHash": "sha256-oyQ4ygkPMhgjJXdg5K2jxNJ487W7F51FQfyERfp2/Hw=",
         "path": "../systems/quatresaisons",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-cfNImVC9wAtXY3Xl7gsGBMF1dTDcYUQ9Kxd8ZWLq7/E=",
+        "narHash": "sha256-G/V/UqQ+wwkek/dGJYd+nk9W0FTVCs0/oSTUPf05QV4=",
         "path": "../systems/zoldene",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "./private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index 7fa0b4fa9d1ff1de03cc8d0fcf6827e14d2e1254..b0b704552f4d214a209b2868ee6b0d104f1e47f8 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-Xi6/nJc0tvzKA2G78B/8wFsz5AvzdETb0L6JhWbG7CY=",
+        "narHash": "sha256-Yd9Vvt/0KEhv9F03pBFl92CdVVkMKZATRydj0AuPkKY=",
         "path": "../systems/backup-2",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-4aJAofbJwlkzXZQ08yfQUdXFIIyhE/I1uh62TZoEwzw=",
+        "narHash": "sha256-dyKdDwCGS6DrHABVcaAgb8gawz3kq13kFQAZzK0FrvA=",
         "path": "../systems/dilion",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-b/hJTZhCp7ypOTYcrMfOV1Ah8KWM+yc20Nnn3UWJ024=",
+        "narHash": "sha256-9mFf3apvj5y9USQ+nA26Mb2Ft/QdlrBVjQY2bQllFSw=",
         "path": "../systems/eldiron",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-wFk8D4iOZW2iNR/5U3eaZzWWKo57CwApD8OEcfc2s+o=",
+        "narHash": "sha256-lk0Zt0avJlciIxcG3nscv+nRR/t0U1FdnnRvFQm6GUI=",
         "path": "../systems/monitoring-1",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-WEK3g7AjtjWbnB9kQ4Guqyb8QI5xzThG5blFqAU1vNo=",
+        "narHash": "sha256-oyQ4ygkPMhgjJXdg5K2jxNJ487W7F51FQfyERfp2/Hw=",
         "path": "../systems/quatresaisons",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-cfNImVC9wAtXY3Xl7gsGBMF1dTDcYUQ9Kxd8ZWLq7/E=",
+        "narHash": "sha256-G/V/UqQ+wwkek/dGJYd+nk9W0FTVCs0/oSTUPf05QV4=",
         "path": "../systems/zoldene",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "./private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index ad6c58cd38ad1fcf5245197a372e009e16d34fd5..6045fd4d7aa1ee67a4671ad3f0efe06f6a182d15 100644 (file)
           secrets.deleteSecretsVars = true;
           secrets.secretsVars = "/run/keys/vars.yml";
 
+          programs.ssh.package = lib.mkDefault (
+            pkgs.openssh.overrideAttrs(old: rec {
+              patches = old.patches ++ [
+                # Mitigation for CVE https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+                (pkgs.fetchpatch {
+                  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/342bfe5c431fd7828fee8fa7e07a4d8fbfd18618/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
+                  sha256 = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
+                })
+              ];
+            })
+          );
           services.openssh.enable = true;
 
           nixpkgs.overlays =
index 7666ffe9e8432f257856cc178ac840ad35516f24..2241f809aec87975bb6ec0e337de89e5b01fe515 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index 79299f74f508bc25ecd72596e22dabe89d06e4bc..cd3307032ff50aa66650c566236d641690fae6fb 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index b3f3753ec645d52e60125e1e2d318cb902c0bc21..da13d410ea8601f811f4848910ff97687f9cbe8a 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index 942bcda51d8df6d22673a07ab1fb9bd6c9b4ba46..d926190004e2e8307c7508cc876a942b52dd16c9 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index 01acde929af3af924d3ffb9a0d1fb01a4e33f358..1d44989db279aecd6262374333fa28e91a815017 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
index 8be0d598450889ae3e004cfadc1588d3a717cc49..7c46d3a5b7ea6e76a452d13321f51809fe8df3b1 100644 (file)
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-xOq12ZNaKx6JEyOLDl0ulTSbS2TLh6M+TM4X40zykLE=",
+        "narHash": "sha256-K8onwBVKHqV/fe12dgHC5ecUpjU88FEVtgTVTS80l3E=",
         "path": "../../flakes/private/system",
         "type": "path"
       },