From a45b0087f5eed0e1d03a2985cdca079733a1414e Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <hi@m7.rs>
Date: Mon, 19 Aug 2024 11:13:01 -0300
Subject: [PATCH] Revert "hosts/ssh: replace pam_ssh_agent_auth with pam_rssh"

This reverts commit b27c2ee029eb861a9cd5def5c535c79ed25a7c3a.
---
 hosts/common/global/openssh.nix | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/hosts/common/global/openssh.nix b/hosts/common/global/openssh.nix
index fcdea46a..fb58a5ee 100644
--- a/hosts/common/global/openssh.nix
+++ b/hosts/common/global/openssh.nix
@@ -2,7 +2,6 @@
   outputs,
   lib,
   config,
-  pkgs,
   ...
 }: let
   hosts = lib.attrNames outputs.nixosConfigurations;
@@ -55,20 +54,8 @@ in {
   };
 
   # Passwordless sudo when SSH'ing with keys
-  security.pam.services.sudo = {config, ...}: {
-    rules.auth.rssh = {
-      order = config.rules.auth.ssh_agent_auth.order - 1;
-      control = "sufficient";
-      modulePath = "${pkgs.pam_rssh}/lib/libpam_rssh.so";
-      settings.authorized_keys_command =
-        pkgs.writeShellScript "get-authorized-keys"
-        ''
-          cat "/etc/ssh/authorized_keys.d/$1"
-        '';
-    };
+  security.pam.sshAgentAuth = {
+    enable = true;
+    authorizedKeysFiles = ["/etc/ssh/authorized_keys.d/%u"];
   };
-  # Keep SSH_AUTH_SOCK when sudo'ing
-  security.sudo.extraConfig = ''
-    Defaults env_keep+=SSH_AUTH_SOCK
-  '';
 }