anchor.diff:  
       $server->waitForUnit("sshd");
   
  -    $server->succeed("mkdir -m 700 /root/.ssh");
  -    $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
  +    subtest "manual-authkey", sub {
  +      $server->succeed("mkdir -m 700 /root/.ssh");
  +      $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
   
  -    $client->succeed("mkdir -m 700 /root/.ssh");
  -    $client->copyFileFromHost("key", "/root/.ssh/id_dsa");
  -    $client->succeed("chmod 600 /root/.ssh/id_dsa");
  +      $client->succeed("mkdir -m 700 /root/.ssh");
  +      $client->copyFileFromHost("key", "/root/.ssh/id_dsa");
  +      $client->succeed("chmod 600 /root/.ssh/id_dsa");
   
  -    $client->waitForUnit("network.target");
  -    $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");
  -    $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");
  +      $client->waitForUnit("network.target");
  +      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");
  +      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");
  +    };
  +
  +    subtest "configured-authkey", sub {
  +      $client->succeed("cat ${snakeOilPrivateKey} > privkey.snakeoil");
  +      $client->succeed("chmod 600 privkey.snakeoil");
  +      $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .
  +                       " -o StrictHostKeyChecking=no -i privkey.snakeoil" .
  +                       " server true");
  +    };
     '';
   })
  
positive.code: import ./make-test.nix ({ pkgs, ... }: {
  
    nodes = {
  
  
negative.code:         services.openssh.enable = true;
          security.pam.services.sshd.limits =
            [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
          users.extraUsers.root.openssh.authorizedKeys.keys = [
            snakeOilPublicKey
          ];
        };
  
      client =
  