[PATCH] install: Enable SSH in installation image.

Done

Details

4 participants

ng0
Leo Famulari
Ludovic Courtès
Marius Bakke

Owner: unassigned

Submitted by: Marius Bakke

Severity: normal

Marius Bakke wrote on 17 Apr 2017 23:30

Recipients:(address . guix-patches@gnu.org)(name . Marius Bakke)(address . mbakke@fastmail.com)

Message-ID:20170417213030.1489-1-mbakke@fastmail.com

Hi Guix! This patch adds an SSH server to the installation image

to aid remote installations as requested in

https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html

lsh-service depends on networking, so I pulled in a DHCP client too.

It increases the image size by about 29MiB.

* gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE

and LSH-SERVICE.

---

gnu/system/install.scm | 13 +++++++++++++

1 file changed, 13 insertions(+)

Toggle diff (34 lines)diff --git a/gnu/system/install.scm b/gnu/system/install.scm
index 191ccf168..95904f151 100644
--- a/gnu/system/install.scm
+++ b/gnu/system/install.scm
@@ -24,7 +24,9 @@
   #:use-module (guix store)
   #:use-module (guix monads)
   #:use-module ((guix store) #:select (%store-prefix))
+  #:use-module (gnu services networking)
   #:use-module (gnu services shepherd)
+  #:use-module (gnu services ssh)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bootloaders)
@@ -262,6 +264,17 @@ You have been warned.  Thanks for being so brave.
           ;; To facilitate copy/paste.
           (gpm-service)
 
+          ;; Add a DHCP client for networking.
+          (dhcp-client-service)
+
+          ;; Add an SSH server to facilitate remote installs.
+          (lsh-service #:port-number 22
+                       #:root-login? #t
+                       #:password-authentication? #t
+                       ;; The root account is passwordless, so make sure
+                       ;; a password is set before allowing logins.
+                       #:allow-empty-passwords? #f)
+
           ;; Since this is running on a USB stick with a unionfs as the root
           ;; file system, use an appropriate cache configuration.
           (nscd-service (nscd-configuration
-- 
2.12.2

Leo Famulari wrote on 17 Apr 2017 23:54

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 26548@debbugs.gnu.org)

Message-ID:20170417215416.GB32573@jasmine

On Mon, Apr 17, 2017 at 11:30:30PM +0200, Marius Bakke wrote:

Toggle quote (10 lines)> Hi Guix! This patch adds an SSH server to the installation image
> to aid remote installations as requested in
> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
> 
> lsh-service depends on networking, so I pulled in a DHCP client too.
> It increases the image size by about 29MiB.
> 
> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
> and LSH-SERVICE.

I wonder, did you consider using OpenSSH instead? Are there any

advantages to using lsh here?

Marius Bakke wrote on 18 Apr 2017 00:06

Recipients:(name . Leo Famulari)(address . leo@famulari.name)(address . 26548@debbugs.gnu.org)

Message-ID:87vaq2k7sw.fsf@fastmail.com

Leo Famulari <leo@famulari.name> writes:

Toggle quote (14 lines)> On Mon, Apr 17, 2017 at 11:30:30PM +0200, Marius Bakke wrote:
>> Hi Guix! This patch adds an SSH server to the installation image
>> to aid remote installations as requested in
>> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
>> 
>> lsh-service depends on networking, so I pulled in a DHCP client too.
>> It increases the image size by about 29MiB.
>> 
>> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
>> and LSH-SERVICE.
>
> I wonder, did you consider using OpenSSH instead? Are there any
> advantages to using lsh here?

I chose lsh mostly because I thought the GNU live image should use the
GNU ssh implementation. For the intended usage (logging in once with a
password to complete the installation), there is no difference to the
end user. No strong opinion though :-)

ng0 wrote on 18 Apr 2017 00:19

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)

Message-ID:20170417221911.yh3mqezjeoosyt63@abyayala

Marius Bakke transcribed 1.5K bytes:

Toggle quote (22 lines)> Leo Famulari <leo@famulari.name> writes:
> 
> > On Mon, Apr 17, 2017 at 11:30:30PM +0200, Marius Bakke wrote:
> >> Hi Guix! This patch adds an SSH server to the installation image
> >> to aid remote installations as requested in
> >> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
> >> 
> >> lsh-service depends on networking, so I pulled in a DHCP client too.
> >> It increases the image size by about 29MiB.
> >> 
> >> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
> >> and LSH-SERVICE.
> >
> > I wonder, did you consider using OpenSSH instead? Are there any
> > advantages to using lsh here?
> 
> I chose lsh mostly because I thought the GNU live image should use the
> GNU ssh implementation. For the intended usage (logging in once with a
> password to complete the installation), there is no difference to the
> end user. No strong opinion though :-)

Uhm, didn't we choose to default to OpenSSH in the config? Why should the installation
image differ?

There were good reasons against lsh mentioned in the thread.
-- 
PGP and more: https://people.pragmatique.xyz/ng0/

Marius Bakke wrote on 18 Apr 2017 01:01

Recipients:(name . ng0)(address . contact.ng0@cryptolab.net)

Message-ID:87inm2k5a6.fsf@fastmail.com

ng0 <contact.ng0@cryptolab.net> writes:

Toggle quote (28 lines)> Marius Bakke transcribed 1.5K bytes:
>> Leo Famulari <leo@famulari.name> writes:
>> 
>> > On Mon, Apr 17, 2017 at 11:30:30PM +0200, Marius Bakke wrote:
>> >> Hi Guix! This patch adds an SSH server to the installation image
>> >> to aid remote installations as requested in
>> >> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
>> >> 
>> >> lsh-service depends on networking, so I pulled in a DHCP client too.
>> >> It increases the image size by about 29MiB.
>> >> 
>> >> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
>> >> and LSH-SERVICE.
>> >
>> > I wonder, did you consider using OpenSSH instead? Are there any
>> > advantages to using lsh here?
>> 
>> I chose lsh mostly because I thought the GNU live image should use the
>> GNU ssh implementation. For the intended usage (logging in once with a
>> password to complete the installation), there is no difference to the
>> end user. No strong opinion though :-)
>
>
> Uhm, didn't we choose to default to OpenSSH in the config? Why should the installation
> image differ?
>
> There were good reasons against lsh mentioned in the thread.

The only argument I can see is that ~/.ssh/authorized_keys is not
working out of the box. Which is not a huge problem in the ephemeral
live image since most users will just set a password and use that,
instad of copying over or typing out their public key first.

But, I don't have a strong opinion on this and will leave the decision
to those who will ultimately sign this thing and offer to end users (if
networking support is desired at all) :-)

Ludovic Courtès wrote on 18 Apr 2017 10:43

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 26548@debbugs.gnu.org)

Message-ID:87inm2rtqa.fsf@gnu.org

Hello!

Marius Bakke <mbakke@fastmail.com> skribis:

Toggle quote (10 lines)> Hi Guix! This patch adds an SSH server to the installation image
> to aid remote installations as requested in
> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
>
> lsh-service depends on networking, so I pulled in a DHCP client too.
> It increases the image size by about 29MiB.
>
> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
> and LSH-SERVICE.

[...]

Toggle quote (3 lines)

> + ;; Add a DHCP client for networking.

> + (dhcp-client-service)

This is a problem: in the installation instructions, we tell people to

configure networking (possibly wireless) by hand, so we cannot expect

the DHCP client to work directly when the image is booted.

Also, the installation instructions would need to be updated.

However, what we could do, instead, is to add an SSH service that is off

by default (with (start? #f)) and does not depend on ‘networking’. That

way, people would only need to type

herd start ssh-daemon

to get the thing up and running. WDYT?

Toggle quote (3 lines)

> + ;; Add an SSH server to facilitate remote installs.

> + (lsh-service #:port-number 22

I agree with others that we should use OpenSSH here. :-)

Thanks,

Ludo’.

ng0 wrote on 18 Apr 2017 13:06

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)

Message-ID:20170418110628.onyo77k3xg3wcvdq@abyayala

Marius Bakke transcribed 2.2K bytes:

Toggle quote (39 lines)> ng0 <contact.ng0@cryptolab.net> writes:
> 
> > Marius Bakke transcribed 1.5K bytes:
> >> Leo Famulari <leo@famulari.name> writes:
> >> 
> >> > On Mon, Apr 17, 2017 at 11:30:30PM +0200, Marius Bakke wrote:
> >> >> Hi Guix! This patch adds an SSH server to the installation image
> >> >> to aid remote installations as requested in
> >> >> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
> >> >> 
> >> >> lsh-service depends on networking, so I pulled in a DHCP client too.
> >> >> It increases the image size by about 29MiB.
> >> >> 
> >> >> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
> >> >> and LSH-SERVICE.
> >> >
> >> > I wonder, did you consider using OpenSSH instead? Are there any
> >> > advantages to using lsh here?
> >> 
> >> I chose lsh mostly because I thought the GNU live image should use the
> >> GNU ssh implementation. For the intended usage (logging in once with a
> >> password to complete the installation), there is no difference to the
> >> end user. No strong opinion though :-)
> >
> >
> > Uhm, didn't we choose to default to OpenSSH in the config? Why should the installation
> > image differ?
> >
> > There were good reasons against lsh mentioned in the thread.
> 
> The only argument I can see is that ~/.ssh/authorized_keys is not
> working out of the box. Which is not a huge problem in the ephemeral
> live image since most users will just set a password and use that,
> instad of copying over or typing out their public key first.
> 
> But, I don't have a strong opinion on this and will leave the decision
> to those who will ultimately sign this thing and offer to end users (if
> networking support is desired at all) :-)

Another point: With OpenSSH you can copy a file over with scp, for example
a system config, without too much work and reading.
With lsh... "it is complicated".

-- 
PGP and more: https://people.pragmatique.xyz/ng0/

ng0 wrote on 18 Apr 2017 13:09

Recipients:(name . Ludovic Courtès)(address . ludo@gnu.org)

Message-ID:20170418110929.opbh7gygi3s2f6zl@abyayala

Ludovic Courtès transcribed 1.2K bytes:

Toggle quote (33 lines)> Hello!
> 
> Marius Bakke <mbakke@fastmail.com> skribis:
> 
> > Hi Guix! This patch adds an SSH server to the installation image
> > to aid remote installations as requested in
> > https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
> >
> > lsh-service depends on networking, so I pulled in a DHCP client too.
> > It increases the image size by about 29MiB.
> >
> > * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
> > and LSH-SERVICE.
> 
> [...]
> 
> > +          ;; Add a DHCP client for networking.
> > +          (dhcp-client-service)
> 
> This is a problem: in the installation instructions, we tell people to
> configure networking (possibly wireless) by hand, so we cannot expect
> the DHCP client to work directly when the image is booted.
> 
> Also, the installation instructions would need to be updated.
> 
> However, what we could do, instead, is to add an SSH service that is off
> by default (with (start? #f)) and does not depend on ‘networking’.  That
> way, people would only need to type
> 
>   herd start ssh-daemon
> 
> to get the thing up and running.  WDYT?

For the moment it's okay I think.

In the futurey, we would ship GuixSD normal and GuixSD server images?

I'm just trying to gather enough data from hosters at the moment

to see what's the best action here and how we can react in the future

(dhcp, agetty, openssh, etc).

Toggle quote (11 lines)> > +          ;; Add an SSH server to facilitate remote installs.
> > +          (lsh-service #:port-number 22
> 
> I agree with others that we should use OpenSSH here.  :-)
> 
> Thanks,
> Ludo’.
> 
> 
> 

PGP and more: https://people.pragmatique.xyz/ng0/

Marius Bakke wrote on 8 May 2017 14:01

Recipients:(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 26548@debbugs.gnu.org)

Message-ID:8760hby2u9.fsf@fastmail.com

Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (33 lines)> Hello!
>
> Marius Bakke <mbakke@fastmail.com> skribis:
>
>> Hi Guix! This patch adds an SSH server to the installation image
>> to aid remote installations as requested in
>> https://lists.gnu.org/archive/html/help-guix/2017-01/msg00047.html
>>
>> lsh-service depends on networking, so I pulled in a DHCP client too.
>> It increases the image size by about 29MiB.
>>
>> * gnu/system/install.scm (%installation-services): Add DHCP-CLIENT-SERVICE
>> and LSH-SERVICE.
>
> [...]
>
>> +          ;; Add a DHCP client for networking.
>> +          (dhcp-client-service)
>
> This is a problem: in the installation instructions, we tell people to
> configure networking (possibly wireless) by hand, so we cannot expect
> the DHCP client to work directly when the image is booted.
>
> Also, the installation instructions would need to be updated.
>
> However, what we could do, instead, is to add an SSH service that is off
> by default (with (start? #f)) and does not depend on ‘networking’.  That
> way, people would only need to type
>
>   herd start ssh-daemon
>
> to get the thing up and running.  WDYT?

I've changed this patch to use OpenSSH, but can't really see how to
override the openssh-shepherd-service to not depend on networking. Any
hints? :-)

Ludovic Courtès wrote on 10 May 2017 22:28

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 26548@debbugs.gnu.org)

Message-ID:8737ccsbha.fsf@gnu.org

Marius Bakke <mbakke@fastmail.com> skribis:

Toggle quote (2 lines)

> Ludovic Courtès <ludo@gnu.org> writes:

[...]

Toggle quote (18 lines)>> This is a problem: in the installation instructions, we tell people to
>> configure networking (possibly wireless) by hand, so we cannot expect
>> the DHCP client to work directly when the image is booted.
>>
>> Also, the installation instructions would need to be updated.
>>
>> However, what we could do, instead, is to add an SSH service that is off
>> by default (with (start? #f)) and does not depend on ‘networking’.  That
>> way, people would only need to type
>>
>>   herd start ssh-daemon
>>
>> to get the thing up and running.  WDYT?
>
> I've changed this patch to use OpenSSH, but can't really see how to
> override the openssh-shepherd-service to not depend on networking. Any
> hints? :-)

Does it make sense in the first place to have it depend on ‘networking’?

Isn’t sshd able to adjust as new interfaces come up and down?

That said, you could do (untested):

(define custom-openssh-service-type

(service-type

(inherit openssh-service-type)

(extensions (cons my-own-shepherd-service-extension

(remove shepherd-service-extension?

(service-type-extensions openssh-service-type))))))

where:

(define (shepherd-service-extension? extension)

(eq? shepherd-root-service-type

(service-extension-target extension)))

(define my-own-shepherd-service-extension

(service-extension shepherd-root-service-type

my-own-proc))

…

Does that make sense?

Ludo’.

Marius Bakke wrote on 17 May 2017 14:14

Recipients:(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 26548@debbugs.gnu.org)

Message-ID:87ziebd6k2.fsf@fastmail.com

Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (27 lines)> Marius Bakke <mbakke@fastmail.com> skribis:
>
>> Ludovic Courtès <ludo@gnu.org> writes:
>
> [...]
>
>>> This is a problem: in the installation instructions, we tell people to
>>> configure networking (possibly wireless) by hand, so we cannot expect
>>> the DHCP client to work directly when the image is booted.
>>>
>>> Also, the installation instructions would need to be updated.
>>>
>>> However, what we could do, instead, is to add an SSH service that is off
>>> by default (with (start? #f)) and does not depend on ‘networking’.  That
>>> way, people would only need to type
>>>
>>>   herd start ssh-daemon
>>>
>>> to get the thing up and running.  WDYT?
>>
>> I've changed this patch to use OpenSSH, but can't really see how to
>> override the openssh-shepherd-service to not depend on networking. Any
>> hints? :-)
>
> Does it make sense in the first place to have it depend on ‘networking’?
> Isn’t sshd able to adjust as new interfaces come up and down?

You're right. I've tested this by starting "ssh-daemon" before

configuring network interfaces on a live UEFI disk image.

New patches incoming!

Marius Bakke wrote on 17 May 2017 14:15

[PATCH v2 1/2] services: openssh: Don't depend on networking.

Recipients:(address . 26548@debbugs.gnu.org)(name . Marius Bakke)(address . mbakke@fastmail.com)

Message-ID:20170517121517.3508-1-mbakke@fastmail.com

* gnu/services/ssh.scm (openssh-shepherd-service): Drop requirement.

---

gnu/services/ssh.scm | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

Toggle diff (15 lines)diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index 9917c311c..2a6c8d45c 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -385,7 +385,7 @@ The other options should be self-descriptive."
 
   (list (shepherd-service
          (documentation "OpenSSH server.")
-         (requirement '(networking syslogd))
+         (requirement '(syslogd))
          (provision '(ssh-daemon))
          (start #~(make-forkexec-constructor #$openssh-command
                                              #:pid-file #$pid-file))
-- 
2.13.0

Marius Bakke wrote on 17 May 2017 14:15

[PATCH v2 2/2] install: Enable SSH in installation image.

Recipients:(address . 26548@debbugs.gnu.org)(name . Marius Bakke)(address . mbakke@fastmail.com)

Message-ID:20170517121517.3508-2-mbakke@fastmail.com

* gnu/system/install.scm (%installation-services): Add OPENSSH-SERVICE.
* doc/guix.texi (Preparing for Installation)[Networking]: Document it.
---
 doc/guix.texi          | 11 +++++++++++
 gnu/system/install.scm | 11 +++++++++++
 2 files changed, 22 insertions(+)

Toggle diff (53 lines)diff --git a/doc/guix.texi b/doc/guix.texi
index b272fcec8..9d3b1fb1f 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -7446,6 +7446,17 @@ ping -c 3 gnu.org
 Setting up network access is almost always a requirement because the
 image does not contain all the software and tools that may be needed.
 
+@cindex installing over SSH
+From here you can proceed to do the rest of the installation remotely
+by starting an SSH server:
+
+@example
+herd start ssh-daemon
+@end example
+
+Make sure to either set a password with @command{passwd}, or configure
+OpenSSH public key authentication before logging in.
+
 @subsubsection Disk Partitioning
 
 Unless this has already been done, the next step is to partition, and
diff --git a/gnu/system/install.scm b/gnu/system/install.scm
index 191ccf168..327406b72 100644
--- a/gnu/system/install.scm
+++ b/gnu/system/install.scm
@@ -25,6 +25,7 @@
   #:use-module (guix monads)
   #:use-module ((guix store) #:select (%store-prefix))
   #:use-module (gnu services shepherd)
+  #:use-module (gnu services ssh)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bootloaders)
@@ -262,6 +263,16 @@ You have been warned.  Thanks for being so brave.
           ;; To facilitate copy/paste.
           (gpm-service)
 
+          ;; Add an SSH server to facilitate remote installs.
+          (service openssh-service-type
+                   (openssh-configuration
+                    (port-number 22)
+                    (permit-root-login #t)
+                    ;; The root account is passwordless, so make sure
+                    ;; a password is set before allowing logins.
+                    (allow-empty-passwords? #f)
+                    (password-authentication? #t)))
+
           ;; Since this is running on a USB stick with a unionfs as the root
           ;; file system, use an appropriate cache configuration.
           (nscd-service (nscd-configuration
-- 
2.13.0

Ludovic Courtès wrote on 17 May 2017 23:29

Re: bug#26548: [PATCH v2 1/2] services: openssh: Don't depend on networking.

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 26548@debbugs.gnu.org)

Message-ID:87vaoztbnp.fsf@gnu.org

Marius Bakke <mbakke@fastmail.com> skribis:

Toggle quote (19 lines)> * gnu/services/ssh.scm (openssh-shepherd-service): Drop requirement.
> ---
>  gnu/services/ssh.scm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
> index 9917c311c..2a6c8d45c 100644
> --- a/gnu/services/ssh.scm
> +++ b/gnu/services/ssh.scm
> @@ -385,7 +385,7 @@ The other options should be self-descriptive."
>  
>    (list (shepherd-service
>           (documentation "OpenSSH server.")
> -         (requirement '(networking syslogd))
> +         (requirement '(syslogd))
>           (provision '(ssh-daemon))
>           (start #~(make-forkexec-constructor #$openssh-command
>                                               #:pid-file #$pid-file))

OK! (Please make sure “make check-system TESTS=openssh” still works.)

Thanks,

Ludo’.

Ludovic Courtès wrote on 17 May 2017 23:36

Re: bug#26548: [PATCH v2 2/2] install: Enable SSH in installation image.

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 26548@debbugs.gnu.org)

Message-ID:87r2zntbbp.fsf@gnu.org

Marius Bakke <mbakke@fastmail.com> skribis:

Toggle quote (3 lines)

> * gnu/system/install.scm (%installation-services): Add OPENSSH-SERVICE.

> * doc/guix.texi (Preparing for Installation)[Networking]: Document it.

[...]

Toggle quote (4 lines)

> +@cindex installing over SSH

> +From here you can proceed to do the rest of the installation remotely

> +by starting an SSH server:

Maybe s/From here/If you want to, / to clarify that people are not

required to do this?

Otherwise LGTM!

How does this affect:

guix size $(./pre-inst-env guix system build gnu/system/install.scm)

Thank you!

Ludo’.

Marius Bakke wrote on 18 May 2017 01:01

Recipients:(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 26548-done@debbugs.gnu.org)

Message-ID:87efvncclc.fsf@fastmail.com

Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (14 lines)> Marius Bakke <mbakke@fastmail.com> skribis:
>
>> * gnu/system/install.scm (%installation-services): Add OPENSSH-SERVICE.
>> * doc/guix.texi (Preparing for Installation)[Networking]: Document it.
>
> [...]
>
>> +@cindex installing over SSH
>> +From here you can proceed to do the rest of the installation remotely
>> +by starting an SSH server:
>
> Maybe s/From here/If you want to, / to clarify that people are not
> required to do this?

Thanks, fixed!

Toggle quote (6 lines)

> Otherwise LGTM!

> How does this affect:

> guix size $(./pre-inst-env guix system build gnu/system/install.scm)

Before: 882.1MiB

After: 910.0MiB

"make check-system TESTS=openssh" passes. Pushed!

Closed

Your comment

This issue is archived.

To comment on this conversation send an email to 26548@debbugs.gnu.org

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date