From ec8751941bbc81ad5b8512086a8f95f09611dbe2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kjetil=20=C3=98rbekk?= <kj@orbekk.com>
Date: Thu, 23 Aug 2018 19:51:28 -0400
Subject: Add readonly user

---
 machines/dragon.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'machines')

diff --git a/machines/dragon.nix b/machines/dragon.nix
index d6b72ec..0fa5559 100644
--- a/machines/dragon.nix
+++ b/machines/dragon.nix
@@ -139,10 +139,16 @@ in
   # XXX: temorary hack because of an accidental upgrade.
   systemd.services.lxd.serviceConfig.ExecStart = lib.mkForce "@${pkgs.lxd.bin}/bin/lxd lxd --group lxd";
 
+  # Required to enable password authentication for one user.
+  security.pam.services.sshd.unixAuth = lib.mkForce true;
   services = {
     openssh = {
       enable = lib.mkDefault true;
       passwordAuthentication = false;
+      extraConfig = ''
+        Match User readonly
+	PasswordAuthentication yes
+      '';
     };
   };
 
-- 
cgit v1.2.3