check the phone's termux dotfiles into the repo [ci-skip] #132
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "phone"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
the phone's been doing
kinit+ GSSAPI ticket-SSH into the fleet for a while now, butits config lived nowhere except the phone. this checks in reference copies so they
don't silently drift from the fleet's own kerberos client config.
phone/sits at the repo root, outside import-tree'smodules/walk - it'sdeliberately inert. termux is an unmanaged android app, there's no module to own
it, so these are hand-synced reference copies rather than declarative config.
static/would've been the other candidate but it's host-scoped, and the phone isa
peersentry indirectory.nix, not a host.krb5/krb5.confmirrors whatsystem/net/krb5.nixgenerates for real hosts.the
rdns = false/dns_canonicalize_hostname = falsepair is load-bearing forthe same reason it's pinned there: WG hosts have no PTR records, so
canonicalization SERVFAILs on the reverse lookup.
ssh/configcarriesCanonicalizeHostname+CanonicalDomains lament.gay, whichis doing more than saving keystrokes - GSSAPI builds the service principal from the
name as typed, so a bare
ssh minervawould ask the KDC forhost/minervaand getnowhere.
MaxDots 0keeps it off anything already qualified.GSSAPIDelegateCredentials noon purpose. a forwarded TGT from a phone meansanything that compromises a fleet host can turn around and act as us.
no nix touched, hence
[ci-skip].server side needed nothing -
kdc.service/kadmind.serviceon verdandi andfleet-wide
GSSAPIAuthenticationwere already in place from the identity tower.phone(and by extension,tablet) become versioned