fix(ssh): enforce SSH public key authentication only in depth

dots/.bash_profile

@@ -2,7 +2,6 @@
 # shellcheck disable=SC1090
 [[ -f ~/.bashrc ]] && . ~/.bashrc
 
-export SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/ssh-agent.socket"
 export _JAVA_AWT_WM_NONREPARENTING=1
 
 if [[ -z "${DISPLAY}" ]] && [[ "${XDG_VTNR}" -eq 1 ]]; then

dots/.bashrc

@@ -97,12 +97,6 @@ export JUPYTERLAB_DIR=$HOME/.local/share/jupyter/lab
 # Zettelkasten {{{
 export ZK_PATH="$HOME/.zk"
 
-# SSH Agent {{{
-if [[ -z "${SSH_CONNECTION}" ]]; then
-    export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"
-fi
-# }}}
-
 
 # Codi
 # Usage: codi [filetype] [filename]

dots/.config/systemd/user/ssh-agent.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=SSH Key agent
-
-[Service]
-Type=simple
-Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
-ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
-
-[Install]
-WantedBy=default.target

home/modules/deploy/colmena-wrapper.bash

@@ -1,6 +1,6 @@
 # `colmena` wrapper script that opens a short-lived SSH master process for
 # `colmena` to use so it works with hardware-backed key touch+PIN. assumes
-# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+# ControlPath ~/.ssh/control/%C (see ../ssh/default.nix)
 
 selector=""
 want_on=0

home/modules/deploy/default.nix

@@ -61,16 +61,5 @@ in
       colmenaWrapped
       deployRsWrapped
     ];
-    programs.ssh.settings = lib.genAttrs hostsWithKeys (
-      hostname:
-      let
-        meta = myUtils.hostMeta (hostDir + "/${hostname}");
-      in
-      {
-        User = meta.host.username;
-        HostName = hostname;
-        ControlPath = "~/.ssh/socket-%r@%h:%p";
-      }
-    );
   };
 }

home/modules/deploy/deploy-rs-wrapper.bash

@@ -1,6 +1,6 @@
 # `deploy` wrapper script that opens a short-lived SSH master process for
 # `deploy-rs` to use so it works with hardware-backed key touch+PIN. assumes
-# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+# ControlPath ~/.ssh/control/%C (see ../ssh/default.nix)
 
 # extract the target host from the `deploy-rs` flake target (e.g. `.#hecuba`)
 node=""

home/modules/keepassxc/default.nix

@@ -15,6 +15,7 @@ in
       enable = true;
       settings = {
         Browser.Enabled = true;
+        SSHAgent.Enabled = true;
       };
     };
   };

home/modules/ssh/default.nix

@@ -2,11 +2,17 @@
   config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
 
 let
   cfg = config.ssh;
+
+  hostDir = ../../../hosts;
+  hostsWithKeys = lib.filter (hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")) (
+    myUtils.dirNames hostDir
+  );
 in
 {
   options.ssh.enable = lib.mkEnableOption "ssh";
@@ -14,20 +20,44 @@ in
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [ sshfs ];
 
+    home.file.".ssh/control/.keep".text = "";
+
+    services.ssh-agent.enable = true;
+
+    systemd.user.services.ssh-agent.Service.Environment = [
+      "SSH_ASKPASS=${pkgs.lxqt.lxqt-openssh-askpass}/bin/lxqt-openssh-askpass"
+      "SSH_ASKPASS_REQUIRE=prefer"
+    ];
+
     programs.ssh = {
       enable = true;
       enableDefaultConfig = false;
 
-      settings = {
+      settings =
-        "*" = {
+        lib.genAttrs hostsWithKeys (
-          AddKeysToAgent = "yes";
+          hostname:
-          ForwardAgent = false;
+          let
-          identityFile = [
+            meta = myUtils.hostMeta (hostDir + "/${hostname}");
-            "~/.ssh/id_ed25519_sk"
+          in
-            "~/.ssh/id_ed25519_sk_bak"
+          {
-          ];
+            User = meta.host.username;
+            HostName = hostname;
+          }
+        )
+        // {
+          "*" = {
+            AddKeysToAgent = "yes";
+            ForwardAgent = false;
+            identityFile = [
+              "~/.ssh/id_ed25519_sk"
+              "~/.ssh/id_ed25519_sk_bak"
+            ];
+            IdentitiesOnly = true;
+            ControlMaster = "auto";
+            ControlPath = "~/.ssh/control/%C";
+            ControlPersist = "10m";
+          };
         };
-      };
     };
   };
 }

modules/ssh/hardened-openssh.nix

@@ -20,6 +20,7 @@ in
     services.openssh.settings = optionalAttrs cfg.harden {
       PermitRootLogin = "no";
       PasswordAuthentication = false;
+      AuthenticationMethods = "publickey";
       KbdInteractiveAuthentication = false;
       ChallengeResponseAuthentication = false;
       X11Forwarding = false;