aboutsummaryrefslogtreecommitdiff
path: root/nixos/modules/security/pam.nix (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-11-24pam_ssh_agent_auth: Honour services.openssh.authorizedKeysFilesadisbladis1-1/+1
If a system administrator has explicitly configured key locations this should be taken into account by `sudo`.
2020-10-12pam: add support for pam_gnupgNick Hu1-0/+45
2020-10-09nixos/pam: remove trailing whitespacezowoq1-1/+1
2020-10-08nixos/pam: Add option to set pam-u2f appid (#73591)Miles Breslin1-1/+17
2020-10-07Revert "apparmor: fix and improve the service"Vladimír Čunát1-55/+0
This reverts commit fb6d63f3fdd95a5468d43a0693c8ca7c1894363f. I really hope this finally fixes #99236: evaluation on Hydra. This time I really did check basically the same commit on Hydra: https://hydra.nixos.org/eval/1618011 Right now I don't have energy to find what exactly is wrong in the commit, and it doesn't seem important in comparison to nixos-unstable channel being stuck on a commit over one week old.
2020-10-05pam: Fix interaction with sambaTim Steinbach1-2/+0
9544c6078e12aacaf17abc9a13e740658b17e747 / #96672 removed the samba option `syncPasswordsByPam`. Need to remove this option from the pam module, otherwise it will cause build errors
2020-09-08Remove Qt 5.15 from Plasma closureThomas Tuegel1-2/+2
2020-09-06apparmor: fix and improve the serviceJulien Moutinho1-0/+57
2020-09-02treewide: completely remove types.loaOfrnhmjoj1-1/+1
2020-08-30nixos/samba: remove upstream deprecated syncPasswordsByPam optionDoron Behar1-2/+0
2020-07-25pam_p11: addSebastien Bourdeauducq1-0/+47
2020-06-04nixos/pam: mount encrypted home earlierPeter Hoeg1-2/+2
This patch was done by curro: The generated /etc/pam.d/* service files invoke the pam_systemd.so session module before pam_mount.so, if both are enabled (e.g. via security.pam.services.foo.startSession and security.pam.services.foo.pamMount respectively). This doesn't work in the most common scenario where the user's home directory is stored in a pam-mounted encrypted volume (because systemd will fail to access the user's systemd configuration).
2020-05-12pam: fix spelling mistake in configurationTimmy Xiao1-1/+1
2020-04-27treewide: add types to boolean / enable options or make use of mkEnableOptionDominik Xaver Hörl1-12/+3
2020-02-24nixos/security/pam: Add nodelay optionChristian Lütke-Stetzkamp1-2/+10
Closes #65551
2020-01-06treewide: use attrs instead of list for types.loaOf optionsrnhmjoj1-5/+4
2020-01-03pam: remove unused ftp serviceJörg Thalheim1-1/+0
vsftpd is the only ftp server module and defines its own pam service.
2020-01-03pam: remove cups serviceJörg Thalheim1-1/+0
The cups module itself already defines this.
2020-01-03screen: move pam service to moduleJörg Thalheim1-1/+0
2019-12-10nixos/treewide: Move rename.nix imports to their respective modulesSilvan Mosberger1-1/+5
A centralized list for these renames is not good because: - It breaks disabledModules for modules that have a rename defined - Adding/removing renames for a module means having to find them in the central file - Merge conflicts due to multiple people editing the central file
2019-09-23nixos/systemd: pick more upstream tmpfiles confsFranz Pletz1-7/+0
In #68792 it was discovered that /dev/fuse doesn't have wordl-read-writeable permissions anymore. The cause of this is that the tmpfiles examples in systemd were reorganized and split into more files. We thus lost some of the configuration we were depending on. In this commit some of the new tmpfiles configuration that are applicable to us are added which also makes wtmp/lastlog in the pam module not necessary anymore. Rationale for the new tmpfile configs: - `journal-nowcow.conf`: Contains chattr +C for journald logs which makes sense on copy-on-write filesystems like Btrfs. Other filesystems shouldn't do anything funny when that flag is set. - `static-nodes-permissions.conf`: Contains some permission overrides for some device nodes like audio, loop, tun, fuse and kvm. - `systemd-nspawn.conf`: Makes sure `/var/lib/machines` exists and old snapshots are properly removed. - `systemd-tmp.conf`: Removes systemd services related private tmp folders and temporary coredump files. - `var.conf`: Creates some useful directories in `/var` which we would create anyway at some point. Also includes `/var/log/{wtmp,btmp,lastlog}`. Fixes #68792.
2019-09-18nixos/system-environment: introduce environment.profileRelativeSessionVariablesRobert Helgesson1-1/+1
There is a need for having sessionVariables set relative to the Nix Profiles. Such as in #68383.
2019-08-31nixos/modules: Remove all usages of types.stringSilvan Mosberger1-1/+1
And replace them with a more appropriate type Also fix up some minor module problems along the way
2019-08-30yubico-pam: make local authentication possibleEric Wolf1-1/+18
using challenge response see https://developers.yubico.com/yubico-pam/Authentication_Using_Challenge-Response.html
2019-04-14nixos/pam: Add GNOME keyring use_authtok directive to password groupAlexander Kahl1-0/+2
2019-03-31yubico-pam: add nixos integrationWill Dietz1-0/+60
2019-02-24nixos/security: Add duo-unix support to pam.Scott Dier1-3/+18
Also whitespace cleanup of surrounding code.
2019-01-29nixos/pam: refactor U2F, docs about u2f_keys path (#54756)Wael Nasreddine1-11/+98
* change enableU2F option to u2f.* set * add few u2f options (not all) to customize pam-u2f module * document default u2f_keys locations Co-authored-by: Tomasz Czyż <tomasz.czyz@gmail.com> Co-authored-by: Arda Xi <arda@ardaxi.com>
2019-01-18nixos/tests: test LDAP password changing through nslcdJulien Moutinho1-1/+1
NOTE: slapd.conf is deprecated, hence use cn=config.
2018-12-21security.pam.services.<name?>.: add ↵Florian Klink1-0/+30
googleOsLogin(AccountVerification|Authentication)
2018-12-21security.pam: make pam_unix.so required, not sufficientFlorian Klink1-1/+1
Having pam_unix set to "sufficient" means early-succeeding account management group, as soon as pam_unix.so is succeeding. This is not sufficient. For example, nixos modules might install nss modules for user lookup, so pam_unix.so succeeds, and we end the stack successfully, even though other pam account modules might want to do more extensive checks. Other distros seem to set pam_unix.so to 'required', so if there are other pam modules in that management group, they get a chance to do some validation too. For SSSD, @PsyanticY already added a workaround knob in https://github.com/NixOS/nixpkgs/pull/31969, while stating this should be the default anyway. I did some thinking in what could break - after this commit, we require pam_unix to succeed, means we require `getent passwd $username` to return something. This is the case for all local users due to the passwd nss module, and also the case for all modules installing their nss module to nsswitch.conf - true for ldap (if not explicitly disabled) and sssd. I'm not so sure about krb5, cc @eqyiel for opinions. Is there some nss module loaded? Should the pam account module be placed before pam_unix? We don't drop the `security.pam.services.<name?>.sssdStrictAccess` option, as it's also used some lines below to tweak error behaviour inside the pam sssd module itself (by changing it's 'control' field). This is also required to get admin login for Google OS Login working (#51566), as their pam_oslogin_admin accounts module takes care of sudo configuration.
2018-09-30nixos/pam: create wtmp/lastlog iff using pam_lastlogJamey Sharp1-0/+7
I think pam_lastlog is the only thing that writes to these files in practice on a modern Linux system, so in a configuration that doesn't use that module, we don't need to create these files. I used tmpfiles.d instead of activation snippets to create the logs. It's good enough for upstream and other distros; it's probably good enough for us.
2018-05-12manual: Clarify that limits.conf doesn't apply to systemd services. (#40267)Niklas Hambüchen1-0/+4
Say how systemd services can be set instead. Sources: * https://bugzilla.redhat.com/show_bug.cgi?id=754285 * https://ro-che.info/articles/2017-03-26-increase-open-files-limit Signed-off-by: Niklas Hambüchen <mail@nh2.me>
2018-04-09lxc: enable pam_cgfs and fix moduleJörg Thalheim1-1/+1
pam_cgfs was part in lxcfs before and moved here fixes #37985
2018-02-25tree-wide: autorename gnome packages to use dashesJan Tojnar1-2/+2
2018-02-09nixos/pam: support for Google AuthenticatorDawid Ciężarkiewicz1-1/+20
2018-01-01pam: add optional pam_gnome_keyring integrationgnidorah1-1/+16
2017-12-21Make less known wayland compositors usable (#32285)gnidorah1-1/+0
* bemenu: init at 2017-02-14 * velox: 2015-11-03 -> 2017-07-04 * orbment, velox: don't expose subprojects the development of orbment and velox got stuck their subprojects (bemenu, dmenu-wayland, st-wayland) don't work correctly outside of parent projects so hide them to not confuse people swc and wld libraries are unpopular and unlike wlc are not used by anything except velox * pythonPackages.pydbus: init at 0.6.0 * way-cooler: 0.5.2 -> 0.6.2 * nixos/way-cooler: add module * dconf module: use for wayland non-invasive approach for #31293 see discussion at #32210 * sway: embed LD_LIBRARY_PATH for #32755 * way-cooler: switch from buildRustPackage to buildRustCrate #31150
2017-11-22Update sssd integration with pam as documented by RedHatAssassinkin1-2/+9
2017-11-17nixos/pam: fix docs about path to u2f_keys fileBjørn Forsman1-1/+1
Looking at upstream git repo (git://github.com/Yubico/pam-u2f.git) the docs initially said the path was ~/.yubico/u2f_keys, but it was later changed to ~/.config/Yubico/u2f_keys (in 2015). I have run pam_u2f.so with "debug" option and observed that the correct path indeed is ~/.config/Yubico/u2f_keys.
2017-11-02pam, lxcfs: enable pam_cgfsRichard Marko1-0/+2
Related to #30023
2017-10-20nixos/ecryptfs: initedef1-6/+4
Currently, ecryptfs support is coupled to `security.pam.enableEcryptfs`, but one might want to use ecryptfs without enabling the PAM functionality. This commit splits it out into a `boot.supportedFilesystems` switch.
2017-10-20nixos/pam: add swaylock (#29919)gnidorah1-0/+1
2017-08-22nixos: Fix pam_kwallet5 integrationBenjamin Staffin1-2/+2
Fixes #28469
2017-02-27Remove top-level kde5 attributeThomas Tuegel1-4/+4
- There is no such thing as KDE 5
2017-02-16pam: add optional pam_kwallet5 integrationBenjamin Staffin1-1/+18
2017-02-12pam_oath: require OATH and pam_unix credentials to be validGraham Christensen1-2/+2
2017-01-29Set merge + mkIf always surprises meParnell Springmeyer1-2/+2
2017-01-29I'm clearly very tiredParnell Springmeyer1-3/+0
2017-01-29Syntax wibbleParnell Springmeyer1-1/+1
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 06:20:53 +0000