2009-05-28 14:10:02 +01:00
|
|
|
|
# This module provides configuration for the PAM (Pluggable
|
|
|
|
|
# Authentication Modules) system.
|
|
|
|
|
|
2014-04-14 15:26:48 +01:00
|
|
|
|
{ config, lib, pkgs, ... }:
|
2009-05-28 14:10:02 +01:00
|
|
|
|
|
2014-04-14 15:26:48 +01:00
|
|
|
|
with lib;
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
2009-05-28 14:10:02 +01:00
|
|
|
|
let
|
2014-05-05 20:18:53 +01:00
|
|
|
|
parentConfig = config;
|
2009-05-28 14:10:02 +01:00
|
|
|
|
|
2014-05-05 20:18:53 +01:00
|
|
|
|
pamOpts = { config, name, ... }: let cfg = config; in let config = parentConfig; in {
|
2013-10-15 13:47:51 +01:00
|
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
|
|
|
|
name = mkOption {
|
|
|
|
|
example = "sshd";
|
2013-10-30 10:02:04 +00:00
|
|
|
|
type = types.str;
|
2013-10-15 13:47:51 +01:00
|
|
|
|
description = "Name of the PAM service.";
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 14:05:49 +01:00
|
|
|
|
unixAuth = mkOption {
|
|
|
|
|
default = true;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether users can log in with passwords defined in
|
|
|
|
|
<filename>/etc/shadow</filename>.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
rootOK = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, root doesn't need to authenticate (e.g. for the
|
|
|
|
|
<command>useradd</command> service).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-05-03 15:29:42 +01:00
|
|
|
|
u2fAuth = mkOption {
|
|
|
|
|
default = config.security.pam.enableU2F;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, users listed in
|
2017-11-17 16:37:46 +00:00
|
|
|
|
<filename>~/.config/Yubico/u2f_keys</filename> are able to log in
|
2015-05-03 15:29:42 +01:00
|
|
|
|
with the associated U2F key.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2018-02-08 07:18:30 +00:00
|
|
|
|
googleAuthenticator = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, users with enabled Google Authenticator (created
|
|
|
|
|
<filename>~/.google_authenticator</filename>) will be required
|
|
|
|
|
to provide Google Authenticator token to log in.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
usbAuth = mkOption {
|
|
|
|
|
default = config.security.pam.usb.enable;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, users listed in
|
|
|
|
|
<filename>/etc/pamusb.conf</filename> are able to log in
|
|
|
|
|
with the associated USB key.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
otpwAuth = mkOption {
|
|
|
|
|
default = config.security.pam.enableOTPW;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, the OTPW system will be used (if
|
|
|
|
|
<filename>~/.otpw</filename> exists).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-01-03 16:47:38 +00:00
|
|
|
|
fprintAuth = mkOption {
|
|
|
|
|
default = config.services.fprintd.enable;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, fingerprint reader will be used (if exists and
|
|
|
|
|
your fingerprints are enrolled).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-02-14 22:52:22 +00:00
|
|
|
|
oathAuth = mkOption {
|
2016-02-24 21:41:02 +00:00
|
|
|
|
default = config.security.pam.oath.enable;
|
2015-02-14 22:52:22 +00:00
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, the OATH Toolkit will be used.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
sshAgentAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, the calling user's SSH agent is used to authenticate
|
|
|
|
|
against the keys in the calling user's
|
|
|
|
|
<filename>~/.ssh/authorized_keys</filename>. This is useful
|
|
|
|
|
for <command>sudo</command> on password-less remote systems.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
startSession = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If set, the service will register a new session with
|
|
|
|
|
systemd's login manager. For local sessions, this will give
|
|
|
|
|
the user access to audio devices, CD-ROM drives. In the
|
|
|
|
|
default PolicyKit configuration, it also allows the user to
|
|
|
|
|
reboot the system.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2016-09-06 16:23:27 +01:00
|
|
|
|
setEnvironment = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = true;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether the service should set the environment variables
|
|
|
|
|
listed in <option>environment.sessionVariables</option>
|
|
|
|
|
using <literal>pam_env.so</literal>.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
setLoginUid = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Set the login uid of the process
|
|
|
|
|
(<filename>/proc/self/loginuid</filename>) for auditing
|
|
|
|
|
purposes. The login uid is only set by ‘entry points’ like
|
|
|
|
|
<command>login</command> and <command>sshd</command>, not by
|
|
|
|
|
commands like <command>sudo</command>.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
forwardXAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether X authentication keys should be passed from the
|
|
|
|
|
calling user to the target user (e.g. for
|
|
|
|
|
<command>su</command>)
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-07-02 15:46:56 +01:00
|
|
|
|
pamMount = mkOption {
|
|
|
|
|
default = config.security.pam.mount.enable;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Enable PAM mount (pam_mount) system to mount fileystems on user login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
allowNullPassword = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether to allow logging into accounts that have no password
|
|
|
|
|
set (i.e., have an empty password field in
|
|
|
|
|
<filename>/etc/passwd</filename> or
|
|
|
|
|
<filename>/etc/group</filename>). This does not enable
|
|
|
|
|
logging into disabled accounts (i.e., that have the password
|
|
|
|
|
field set to <literal>!</literal>). Note that regardless of
|
|
|
|
|
what the pam_unix documentation says, accounts with hashed
|
|
|
|
|
empty passwords are always allowed to log in.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2012-09-16 18:14:19 +01:00
|
|
|
|
|
2014-05-16 21:37:44 +01:00
|
|
|
|
requireWheel = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether to permit root access only to members of group wheel.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
limits = mkOption {
|
|
|
|
|
description = ''
|
|
|
|
|
Attribute set describing resource limits. Defaults to the
|
|
|
|
|
value of <option>security.pam.loginLimits</option>.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2009-05-28 14:10:02 +01:00
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
showMotd = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = "Whether to show the message of the day.";
|
|
|
|
|
};
|
2009-08-16 16:46:24 +01:00
|
|
|
|
|
2014-04-15 15:46:35 +01:00
|
|
|
|
makeHomeDir = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether to try to create home directories for users
|
|
|
|
|
with <literal>$HOME</literal>s pointing to nonexistent
|
|
|
|
|
locations on session login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
updateWtmp = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = "Whether to update <filename>/var/log/wtmp</filename>.";
|
|
|
|
|
};
|
2010-01-12 11:02:23 +00:00
|
|
|
|
|
2014-05-14 16:53:58 +01:00
|
|
|
|
logFailures = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
|
|
|
|
|
};
|
|
|
|
|
|
2015-04-18 22:15:35 +01:00
|
|
|
|
enableAppArmor = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
Enable support for attaching AppArmor profiles at the
|
|
|
|
|
user/group level, e.g., as part of a role based access
|
|
|
|
|
control scheme.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2017-02-15 00:38:52 +00:00
|
|
|
|
enableKwallet = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If enabled, pam_wallet will attempt to automatically unlock the
|
|
|
|
|
user's default KDE wallet upon login. If the user has no wallet named
|
|
|
|
|
"kdewallet", or the login password does not match their wallet
|
|
|
|
|
password, KDE will prompt separately after login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2017-11-22 17:07:04 +00:00
|
|
|
|
sssdStrictAccess = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = "enforce sssd access control";
|
|
|
|
|
};
|
2017-02-15 00:38:52 +00:00
|
|
|
|
|
2017-10-22 13:42:00 +01:00
|
|
|
|
enableGnomeKeyring = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = ''
|
|
|
|
|
If enabled, pam_gnome_keyring will attempt to automatically unlock the
|
|
|
|
|
user's default Gnome keyring upon login. If the user login password does
|
|
|
|
|
not match their keyring password, Gnome Keyring will prompt separately
|
|
|
|
|
after login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
text = mkOption {
|
2013-10-30 16:37:45 +00:00
|
|
|
|
type = types.nullOr types.lines;
|
2013-10-15 13:47:51 +01:00
|
|
|
|
description = "Contents of the PAM service file.";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
2014-05-05 20:18:53 +01:00
|
|
|
|
config = {
|
|
|
|
|
name = mkDefault name;
|
2013-10-15 13:47:51 +01:00
|
|
|
|
setLoginUid = mkDefault cfg.startSession;
|
|
|
|
|
limits = mkDefault config.security.pam.loginLimits;
|
2012-10-23 14:10:48 +01:00
|
|
|
|
|
2013-10-15 13:47:51 +01:00
|
|
|
|
# !!! TODO: move the LDAP stuff to the LDAP module, and the
|
|
|
|
|
# Samba stuff to the Samba module. This requires that the PAM
|
|
|
|
|
# module provides the right hooks.
|
|
|
|
|
text = mkDefault
|
2015-11-21 21:04:11 +00:00
|
|
|
|
(''
|
2009-08-16 15:49:14 +01:00
|
|
|
|
# Account management.
|
2017-11-22 17:07:04 +00:00
|
|
|
|
account ${if cfg.sssdStrictAccess then "required" else "sufficient"} pam_unix.so
|
2016-07-18 14:20:21 +01:00
|
|
|
|
${optionalString use_ldap
|
2011-04-13 21:48:50 +01:00
|
|
|
|
"account sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
|
2017-11-22 17:07:04 +00:00
|
|
|
|
${optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false)
|
2016-04-14 19:18:09 +01:00
|
|
|
|
"account sufficient ${pkgs.sssd}/lib/security/pam_sss.so"}
|
2017-11-22 17:07:04 +00:00
|
|
|
|
${optionalString (config.services.sssd.enable && cfg.sssdStrictAccess)
|
|
|
|
|
"account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so"}
|
2010-08-06 09:50:48 +01:00
|
|
|
|
${optionalString config.krb5.enable
|
|
|
|
|
"account sufficient ${pam_krb5}/lib/security/pam_krb5.so"}
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
|
|
|
|
# Authentication management.
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.rootOK
|
2009-08-16 15:49:14 +01:00
|
|
|
|
"auth sufficient pam_rootok.so"}
|
2014-05-16 21:37:44 +01:00
|
|
|
|
${optionalString cfg.requireWheel
|
|
|
|
|
"auth required pam_wheel.so use_uid"}
|
2014-05-14 16:53:58 +01:00
|
|
|
|
${optionalString cfg.logFailures
|
|
|
|
|
"auth required pam_tally.so"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
|
2012-12-17 20:08:29 +00:00
|
|
|
|
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
|
2015-01-03 16:47:38 +00:00
|
|
|
|
${optionalString cfg.fprintAuth
|
|
|
|
|
"auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so"}
|
2015-05-03 15:29:42 +01:00
|
|
|
|
${optionalString cfg.u2fAuth
|
|
|
|
|
"auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.usbAuth
|
2012-06-11 23:41:07 +01:00
|
|
|
|
"auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
|
2017-02-12 23:17:08 +00:00
|
|
|
|
${let oath = config.security.pam.oath; in optionalString cfg.oathAuth
|
|
|
|
|
"auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"}
|
2015-11-21 21:04:11 +00:00
|
|
|
|
'' +
|
|
|
|
|
# Modules in this block require having the password set in PAM_AUTHTOK.
|
|
|
|
|
# pam_unix is marked as 'sufficient' on NixOS which means nothing will run
|
|
|
|
|
# after it succeeds. Certain modules need to run after pam_unix
|
|
|
|
|
# prompts the user for password so we run it once with 'required' at an
|
|
|
|
|
# earlier point and it will run again with 'sufficient' further down.
|
|
|
|
|
# We use try_first_pass the second time to avoid prompting password twice
|
2018-02-08 07:18:30 +00:00
|
|
|
|
(optionalString (cfg.unixAuth &&
|
|
|
|
|
(config.security.pam.enableEcryptfs
|
|
|
|
|
|| cfg.pamMount
|
|
|
|
|
|| cfg.enableKwallet
|
|
|
|
|
|| cfg.enableGnomeKeyring
|
|
|
|
|
|| cfg.googleAuthenticator.enable)) ''
|
2015-11-21 21:04:11 +00:00
|
|
|
|
auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
|
|
|
|
|
${optionalString config.security.pam.enableEcryptfs
|
|
|
|
|
"auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
|
|
|
|
|
${optionalString cfg.pamMount
|
|
|
|
|
"auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
|
2017-02-15 00:38:52 +00:00
|
|
|
|
${optionalString cfg.enableKwallet
|
2017-02-25 18:25:44 +00:00
|
|
|
|
("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
|
2017-08-22 16:46:16 +01:00
|
|
|
|
" kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
|
2017-10-22 13:42:00 +01:00
|
|
|
|
${optionalString cfg.enableGnomeKeyring
|
2018-02-25 02:23:58 +00:00
|
|
|
|
("auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so")}
|
2018-02-08 07:18:30 +00:00
|
|
|
|
${optionalString cfg.googleAuthenticator.enable
|
|
|
|
|
"auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"}
|
2015-11-21 21:04:11 +00:00
|
|
|
|
'') + ''
|
2013-10-15 14:05:49 +01:00
|
|
|
|
${optionalString cfg.unixAuth
|
2015-11-21 21:04:11 +00:00
|
|
|
|
"auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.otpwAuth
|
2013-03-30 20:06:23 +00:00
|
|
|
|
"auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
|
2016-07-18 14:20:21 +01:00
|
|
|
|
${optionalString use_ldap
|
2011-04-13 21:48:50 +01:00
|
|
|
|
"auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
|
2016-04-14 19:18:09 +01:00
|
|
|
|
${optionalString config.services.sssd.enable
|
|
|
|
|
"auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass"}
|
2012-06-11 23:41:07 +01:00
|
|
|
|
${optionalString config.krb5.enable ''
|
|
|
|
|
auth [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass
|
|
|
|
|
auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass
|
|
|
|
|
auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass
|
2010-08-06 09:50:48 +01:00
|
|
|
|
''}
|
2015-11-21 21:04:11 +00:00
|
|
|
|
auth required pam_deny.so
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
|
|
|
|
# Password management.
|
2015-08-19 12:14:18 +01:00
|
|
|
|
password requisite pam_unix.so nullok sha512
|
2015-03-05 00:33:05 +00:00
|
|
|
|
${optionalString config.security.pam.enableEcryptfs
|
|
|
|
|
"password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
|
2015-07-02 15:46:56 +01:00
|
|
|
|
${optionalString cfg.pamMount
|
|
|
|
|
"password optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
|
2016-07-18 14:20:21 +01:00
|
|
|
|
${optionalString use_ldap
|
2009-08-16 15:49:14 +01:00
|
|
|
|
"password sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
|
2016-04-14 19:18:09 +01:00
|
|
|
|
${optionalString config.services.sssd.enable
|
|
|
|
|
"password sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_authtok"}
|
2010-08-06 09:50:48 +01:00
|
|
|
|
${optionalString config.krb5.enable
|
|
|
|
|
"password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass"}
|
2009-08-16 15:49:14 +01:00
|
|
|
|
${optionalString config.services.samba.syncPasswordsByPam
|
|
|
|
|
"password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"}
|
|
|
|
|
|
|
|
|
|
# Session management.
|
2016-09-06 16:23:27 +01:00
|
|
|
|
${optionalString cfg.setEnvironment ''
|
|
|
|
|
session required pam_env.so envfile=${config.system.build.pamEnvironment}
|
|
|
|
|
''}
|
2011-04-13 21:48:50 +01:00
|
|
|
|
session required pam_unix.so
|
2014-04-17 10:35:18 +01:00
|
|
|
|
${optionalString cfg.setLoginUid
|
2014-06-27 09:52:01 +01:00
|
|
|
|
"session ${
|
|
|
|
|
if config.boot.isContainer then "optional" else "required"
|
|
|
|
|
} pam_loginuid.so"}
|
2014-04-15 15:46:35 +01:00
|
|
|
|
${optionalString cfg.makeHomeDir
|
2016-04-14 19:18:09 +01:00
|
|
|
|
"session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0022"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.updateWtmp
|
2013-09-22 17:16:22 +01:00
|
|
|
|
"session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
|
2015-03-05 00:33:05 +00:00
|
|
|
|
${optionalString config.security.pam.enableEcryptfs
|
|
|
|
|
"session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
|
2016-07-18 14:20:21 +01:00
|
|
|
|
${optionalString use_ldap
|
2009-08-16 15:49:14 +01:00
|
|
|
|
"session optional ${pam_ldap}/lib/security/pam_ldap.so"}
|
2016-04-14 19:18:09 +01:00
|
|
|
|
${optionalString config.services.sssd.enable
|
|
|
|
|
"session optional ${pkgs.sssd}/lib/security/pam_sss.so"}
|
2010-08-06 09:50:48 +01:00
|
|
|
|
${optionalString config.krb5.enable
|
|
|
|
|
"session optional ${pam_krb5}/lib/security/pam_krb5.so"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.otpwAuth
|
2013-03-30 20:06:23 +00:00
|
|
|
|
"session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.startSession
|
2012-06-15 19:51:48 +01:00
|
|
|
|
"session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString cfg.forwardXAuth
|
2009-08-16 15:49:14 +01:00
|
|
|
|
"session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString (cfg.limits != [])
|
2013-10-17 14:26:48 +01:00
|
|
|
|
"session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits}"}
|
2013-10-15 13:47:51 +01:00
|
|
|
|
${optionalString (cfg.showMotd && config.users.motd != null)
|
2012-10-23 14:10:48 +01:00
|
|
|
|
"session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}
|
2015-07-02 15:46:56 +01:00
|
|
|
|
${optionalString cfg.pamMount
|
|
|
|
|
"session optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
|
2015-04-18 22:15:35 +01:00
|
|
|
|
${optionalString (cfg.enableAppArmor && config.security.apparmor.enable)
|
|
|
|
|
"session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"}
|
2017-02-15 00:38:52 +00:00
|
|
|
|
${optionalString (cfg.enableKwallet)
|
2017-02-25 18:25:44 +00:00
|
|
|
|
("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
|
2017-08-22 16:46:16 +01:00
|
|
|
|
" kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
|
2017-10-22 13:42:00 +01:00
|
|
|
|
${optionalString (cfg.enableGnomeKeyring)
|
2018-02-25 02:23:58 +00:00
|
|
|
|
"session optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start"}
|
2017-11-02 00:35:00 +00:00
|
|
|
|
${optionalString (config.virtualisation.lxc.lxcfs.enable)
|
2018-04-09 08:13:23 +01:00
|
|
|
|
"session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all"}
|
2015-11-21 21:04:11 +00:00
|
|
|
|
'');
|
2013-10-15 13:47:51 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
inherit (pkgs) pam_krb5 pam_ccreds;
|
|
|
|
|
|
2016-07-18 14:20:21 +01:00
|
|
|
|
use_ldap = (config.users.ldap.enable && config.users.ldap.loginPam);
|
2013-10-15 13:47:51 +01:00
|
|
|
|
pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
|
|
|
|
|
|
|
|
|
|
# Create a limits.conf(5) file.
|
|
|
|
|
makeLimitsConf = limits:
|
|
|
|
|
pkgs.writeText "limits.conf"
|
2013-10-17 14:36:59 +01:00
|
|
|
|
(concatMapStrings ({ domain, type, item, value }:
|
|
|
|
|
"${domain} ${type} ${item} ${toString value}\n")
|
|
|
|
|
limits);
|
2013-10-15 13:47:51 +01:00
|
|
|
|
|
|
|
|
|
motd = pkgs.writeText "motd" config.users.motd;
|
|
|
|
|
|
|
|
|
|
makePAMService = pamService:
|
|
|
|
|
{ source = pkgs.writeText "${pamService.name}.pam" pamService.text;
|
|
|
|
|
target = "pam.d/${pamService.name}";
|
2009-05-28 14:10:02 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
in
|
|
|
|
|
|
|
|
|
|
{
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
2010-01-12 11:02:23 +00:00
|
|
|
|
security.pam.loginLimits = mkOption {
|
|
|
|
|
default = [];
|
|
|
|
|
example =
|
|
|
|
|
[ { domain = "ftp";
|
|
|
|
|
type = "hard";
|
|
|
|
|
item = "nproc";
|
|
|
|
|
value = "0";
|
|
|
|
|
}
|
|
|
|
|
{ domain = "@student";
|
|
|
|
|
type = "-";
|
|
|
|
|
item = "maxlogins";
|
|
|
|
|
value = "4";
|
|
|
|
|
}
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
description =
|
2011-08-01 11:17:18 +01:00
|
|
|
|
'' Define resource limits that should apply to users or groups.
|
|
|
|
|
Each item in the list should be an attribute set with a
|
|
|
|
|
<varname>domain</varname>, <varname>type</varname>,
|
|
|
|
|
<varname>item</varname>, and <varname>value</varname>
|
|
|
|
|
attribute. The syntax and semantics of these attributes
|
|
|
|
|
must be that described in the limits.conf(5) man page.
|
2010-01-12 11:02:23 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2009-08-16 15:49:14 +01:00
|
|
|
|
security.pam.services = mkOption {
|
|
|
|
|
default = [];
|
2016-09-11 08:40:12 +01:00
|
|
|
|
type = with types; loaOf (submodule pamOpts);
|
2009-08-16 15:49:14 +01:00
|
|
|
|
description =
|
|
|
|
|
''
|
|
|
|
|
This option defines the PAM services. A service typically
|
|
|
|
|
corresponds to a program that uses PAM,
|
|
|
|
|
e.g. <command>login</command> or <command>passwd</command>.
|
2013-10-15 13:47:51 +01:00
|
|
|
|
Each attribute of this set defines a PAM service, with the attribute name
|
|
|
|
|
defining the name of the service.
|
2009-08-16 15:49:14 +01:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2016-04-14 19:18:09 +01:00
|
|
|
|
security.pam.makeHomeDir.skelDirectory = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "/var/empty";
|
|
|
|
|
example = "/etc/skel";
|
|
|
|
|
description = ''
|
|
|
|
|
Path to skeleton directory whose contents are copied to home
|
|
|
|
|
directories newly created by <literal>pam_mkhomedir</literal>.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2012-06-11 23:41:07 +01:00
|
|
|
|
security.pam.enableSSHAgentAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
description =
|
|
|
|
|
''
|
|
|
|
|
Enable sudo logins if the user's SSH agent provides a key
|
|
|
|
|
present in <filename>~/.ssh/authorized_keys</filename>.
|
|
|
|
|
This allows machines to exclusively use SSH keys instead of
|
|
|
|
|
passwords.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-03-30 20:06:23 +00:00
|
|
|
|
security.pam.enableOTPW = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
description = ''
|
2013-10-15 13:47:51 +01:00
|
|
|
|
Enable the OTPW (one-time password) PAM module.
|
2013-03-30 20:06:23 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-05-03 15:29:42 +01:00
|
|
|
|
security.pam.enableU2F = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
description = ''
|
|
|
|
|
Enable the U2F PAM module.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-03-05 00:33:05 +00:00
|
|
|
|
security.pam.enableEcryptfs = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
description = ''
|
|
|
|
|
Enable eCryptfs PAM module (mounting ecryptfs home directory on login).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2012-10-23 14:10:48 +01:00
|
|
|
|
users.motd = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
|
2015-08-17 18:52:45 +01:00
|
|
|
|
type = types.nullOr types.lines;
|
2012-10-23 14:10:48 +01:00
|
|
|
|
description = "Message of the day shown to users when they log in.";
|
|
|
|
|
};
|
|
|
|
|
|
2009-08-16 15:49:14 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
|
|
|
|
|
|
config = {
|
2010-08-13 15:07:34 +01:00
|
|
|
|
|
2009-08-16 15:49:14 +01:00
|
|
|
|
environment.systemPackages =
|
|
|
|
|
# Include the PAM modules in the system path mostly for the manpages.
|
2010-06-02 20:59:44 +01:00
|
|
|
|
[ pkgs.pam ]
|
2010-08-06 09:50:48 +01:00
|
|
|
|
++ optional config.users.ldap.enable pam_ldap
|
2016-04-14 19:18:09 +01:00
|
|
|
|
++ optional config.services.sssd.enable pkgs.sssd
|
2013-03-30 20:06:23 +00:00
|
|
|
|
++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
|
2015-02-14 22:52:22 +00:00
|
|
|
|
++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
|
2016-02-24 21:41:02 +00:00
|
|
|
|
++ optionals config.security.pam.oath.enable [ pkgs.oathToolkit ]
|
2017-10-07 16:27:46 +01:00
|
|
|
|
++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ];
|
|
|
|
|
|
|
|
|
|
boot.supportedFilesystems = optionals config.security.pam.enableEcryptfs [ "ecryptfs" ];
|
2015-03-05 00:33:05 +00:00
|
|
|
|
|
2017-01-29 11:33:56 +00:00
|
|
|
|
security.wrappers = {
|
|
|
|
|
unix_chkpwd = {
|
|
|
|
|
source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
|
|
|
|
|
owner = "root";
|
|
|
|
|
setuid = true;
|
|
|
|
|
};
|
2017-10-07 16:27:46 +01:00
|
|
|
|
};
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
2009-08-16 16:46:24 +01:00
|
|
|
|
environment.etc =
|
2013-10-15 13:47:51 +01:00
|
|
|
|
mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
|
|
|
|
security.pam.services =
|
2013-10-15 13:47:51 +01:00
|
|
|
|
{ other.text =
|
|
|
|
|
''
|
|
|
|
|
auth required pam_warn.so
|
|
|
|
|
auth required pam_deny.so
|
|
|
|
|
account required pam_warn.so
|
|
|
|
|
account required pam_deny.so
|
|
|
|
|
password required pam_warn.so
|
|
|
|
|
password required pam_deny.so
|
|
|
|
|
session required pam_warn.so
|
|
|
|
|
session required pam_deny.so
|
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
# Most of these should be moved to specific modules.
|
|
|
|
|
cups = {};
|
|
|
|
|
ftp = {};
|
|
|
|
|
i3lock = {};
|
2016-05-15 06:47:31 +01:00
|
|
|
|
i3lock-color = {};
|
2013-10-15 13:47:51 +01:00
|
|
|
|
screen = {};
|
|
|
|
|
vlock = {};
|
|
|
|
|
xlock = {};
|
|
|
|
|
xscreensaver = {};
|
2016-09-06 16:23:27 +01:00
|
|
|
|
|
|
|
|
|
runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };
|
|
|
|
|
|
|
|
|
|
/* FIXME: should runuser -l start a systemd session? Currently
|
|
|
|
|
it complains "Cannot create session: Already running in a
|
|
|
|
|
session". */
|
|
|
|
|
runuser-l = { rootOK = true; unixAuth = false; };
|
2013-10-15 13:47:51 +01:00
|
|
|
|
};
|
2009-08-16 15:49:14 +01:00
|
|
|
|
|
|
|
|
|
};
|
2010-08-13 15:07:34 +01:00
|
|
|
|
|
2009-05-28 14:10:02 +01:00
|
|
|
|
}
|