{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12265","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12265/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12265/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12265/events","html_url":"https://github.com/NixOS/nixpkgs/issues/12265","id":125764539,"number":12265,"title":"services.openssh.extraConfig: \"Match\" configuration may be prepended, sshd fails","user":{"login":"makefu","id":115218,"avatar_url":"https://avatars.githubusercontent.com/u/115218?v=3","gravatar_id":"","url":"https://api.github.com/users/makefu","html_url":"https://github.com/makefu","followers_url":"https://api.github.com/users/makefu/followers","following_url":"https://api.github.com/users/makefu/following{/other_user}","gists_url":"https://api.github.com/users/makefu/gists{/gist_id}","starred_url":"https://api.github.com/users/makefu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/makefu/subscriptions","organizations_url":"https://api.github.com/users/makefu/orgs","repos_url":"https://api.github.com/users/makefu/repos","events_url":"https://api.github.com/users/makefu/events{/privacy}","received_events_url":"https://api.github.com/users/makefu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-09T15:20:56Z","updated_at":"2016-01-10T01:35:10Z","closed_at":null,"body":"When configuration a Match block with openssh.extraConfig it may happen that this extra configuration is getting merged before the rest of the config is added:\r\n```\r\n  services.openssh.enable = true;\r\n  services.openssh.extraConfig = ''\r\n    Match User share\r\n      ChrootDirectory /media\r\n      ForceCommand internal-sftp\r\n      AllowTcpForwarding no\r\n      PermitTunnel no\r\n      X11Forwarding no\r\n  '';\r\n```\r\n\r\nIn some cases this results in the Match block to be prepended which is a real problem for sshd because there is no way to close a match block.\r\n\r\nTo solve this one could either use a new variable without implicit merging by nix like this:\r\n```\r\npkgs.writeText \"sshd-config\" ''\r\nPIDFile \r\nall-the-other-stuff\r\n...\r\n${cfg.extraConfig}\r\n```\r\nor it may be possible to introduce an extra option for Building `Match` entries:\r\n```\r\nservices.openssh.match = { \"User share\" = ''my configuration'' };\r\n```\r\n\r\nAdditionally i think it would be nice to test the configuration after being written with `sshd -tf <config>` and only switch to the configuration if the test succeeded. `pkgs.runCommand` could be used for this, a friend showed me https://github.com/zalora/microgram/blob/dc5adff60602b2e97d20ae942f4c4198655c0395/pkgs/default.nix#L51-L63 which does something similar.\r\n\r\nI really hate being locked out from machines.Giving the sshd a safety net before crashing may be a good idea."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/170299576","html_url":"https://github.com/NixOS/nixpkgs/issues/12265#issuecomment-170299576","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12265","id":170299576,"user":{"login":"rnhmjoj","id":2817565,"avatar_url":"https://avatars.githubusercontent.com/u/2817565?v=3","gravatar_id":"","url":"https://api.github.com/users/rnhmjoj","html_url":"https://github.com/rnhmjoj","followers_url":"https://api.github.com/users/rnhmjoj/followers","following_url":"https://api.github.com/users/rnhmjoj/following{/other_user}","gists_url":"https://api.github.com/users/rnhmjoj/gists{/gist_id}","starred_url":"https://api.github.com/users/rnhmjoj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rnhmjoj/subscriptions","organizations_url":"https://api.github.com/users/rnhmjoj/orgs","repos_url":"https://api.github.com/users/rnhmjoj/repos","events_url":"https://api.github.com/users/rnhmjoj/events{/privacy}","received_events_url":"https://api.github.com/users/rnhmjoj/received_events","type":"User","site_admin":false},"created_at":"2016-01-10T01:35:10Z","updated_at":"2016-01-10T01:35:10Z","body":"I had the exact same problem. After some research I found out you can \"close\" the block with `Match all`. "}}